🔒 [IBM OSPO Security Notification] — IBM/CodeEngine

@uwefassnacht

🔒 [IBM OSPO Security Notification] — IBM/CodeEngine

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @uwefassnacht @smoser-ibm @jeremiaswerner @reggeenr

Dependabot Alerts

Severity	CVE/GHSA	Package	Affected	Patched	Deadline	Fix PR
🟡 medium	CVE-2026-69112	accelerate	<= 1.14.0	—	2026-12-14	—

Code Scanning Alerts

No open code scanning alerts.

Secret Scanning Alerts

No open secret scanning alerts.

🔄 Dependabot Alert Changes

Added: CVE-2026-2391 (low), CVE-2026-27903 (high), CVE-2026-31808 (medium), CVE-2026-25645 (medium), CVE-2026-4867 (high), CVE-2026-4539 (low), CVE-2026-22815 (medium), CVE-2026-34513 (low), CVE-2026-34514 (low), CVE-2026-34515 (medium), CVE-2026-34516 (medium), CVE-2026-34517 (low), CVE-2026-34518 (low), CVE-2026-34519 (low), CVE-2026-34520 (low), CVE-2026-34525 (medium), GHSA-r4q5-vmmm-2653 (medium), CVE-2026-40347 (medium), CVE-2026-41182 (medium), CVE-2026-40175 (medium), CVE-2025-62718 (medium), CVE-2026-41481 (medium), CVE-2026-42035 (high), CVE-2026-42036 (medium), CVE-2026-42033 (high), CVE-2026-42044 (medium), CVE-2026-42040 (low), CVE-2026-42038 (medium), CVE-2026-42037 (medium), CVE-2026-42034 (medium), CVE-2026-42561 (high), CVE-2026-44432 (high), CVE-2026-44431 (high), CVE-2026-45134 (high), CVE-2026-42042 (medium), CVE-2026-42264 (high), CVE-2026-45409 (medium), CVE-2026-8723 (medium), CVE-2026-41907 (medium), CVE-2026-42043 (high), CVE-2026-42041 (medium), CVE-2026-42039 (medium), CVE-2026-44490 (medium), CVE-2026-44494 (high), CVE-2026-44495 (high), CVE-2026-34993 (medium), CVE-2026-47265 (medium), CVE-2026-48710 (medium), CVE-2026-44488 (high), CVE-2026-44496 (high), CVE-2026-44486 (high), CVE-2026-44487 (high), CVE-2026-48775 (medium), CVE-2026-48776 (medium), CVE-2026-25680 (medium), CVE-2025-3000 (low), CVE-2026-12590 (low), CVE-2026-67312 (medium), CVE-2026-67313 (medium), CVE-2026-67316 (medium), CVE-2026-67317 (medium), CVE-2026-67318 (medium), CVE-2026-67319 (medium), CVE-2026-59881 (medium), CVE-2026-69243 (medium), CVE-2026-69244 (high), CVE-2026-67213 (high), CVE-2026-82562 (medium), CVE-2026-82417 (medium), CVE-2026-69112 (medium), CVE-2026-84375 (high), CVE-2026-84445 (high), CVE-2026-75604 (critical), GHSA-2xp9-vwfh-vxw4 (critical), GHSA-rgj7-g3m4-5g8c (high)

🔄 Dependabot Alert Changes

Added: CVE-2024-47764 (low)

Resolved: CVE-2026-2391, CVE-2026-27903, CVE-2026-31808, CVE-2026-25645, CVE-2026-4867, CVE-2026-4539, CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, GHSA-r4q5-vmmm-2653, CVE-2026-40347, CVE-2026-41182, CVE-2026-40175, CVE-2025-62718, CVE-2026-41481, CVE-2026-42035, CVE-2026-42036, CVE-2026-42033, CVE-2026-42044, CVE-2026-42040, CVE-2026-42038, CVE-2026-42037, CVE-2026-42034, CVE-2026-42561, CVE-2026-44432, CVE-2026-44431, CVE-2026-45134, CVE-2026-42042, CVE-2026-42264, CVE-2026-45409, CVE-2026-8723, CVE-2026-41907, CVE-2026-42043, CVE-2026-42041, CVE-2026-42039, CVE-2026-44490, CVE-2026-44494, CVE-2026-44495, CVE-2026-34993, CVE-2026-47265, CVE-2026-48710, CVE-2026-44488, CVE-2026-44496, CVE-2026-44486, CVE-2026-44487, CVE-2026-48775, CVE-2026-48776, CVE-2026-25680, CVE-2025-3000, CVE-2026-12590, CVE-2026-67312, CVE-2026-67313, CVE-2026-67316, CVE-2026-67317, CVE-2026-67318, CVE-2026-67319, CVE-2026-59881, CVE-2026-69243, CVE-2026-69244, CVE-2026-67213, CVE-2026-82562, CVE-2026-82417, CVE-2026-84375, CVE-2026-84445, CVE-2026-75604, GHSA-2xp9-vwfh-vxw4, GHSA-rgj7-g3m4-5g8c

🔄 Dependabot Alert Changes

Resolved: CVE-2024-47764, CVE-2026-69112

🔄 Code & Secret Scanning Alert Changes

Resolved: cs-31 (code-scanning), cs-30 (code-scanning), cs-29 (code-scanning), cs-28 (code-scanning), cs-27 (code-scanning), cs-26 (code-scanning), cs-25 (code-scanning), cs-24 (code-scanning), cs-23 (code-scanning), cs-22 (code-scanning), cs-21 (code-scanning), cs-20 (code-scanning), cs-19 (code-scanning), cs-18 (code-scanning), cs-17 (code-scanning), cs-16 (code-scanning), cs-15 (code-scanning), cs-14 (code-scanning), cs-13 (code-scanning), cs-12 (code-scanning), cs-11 (code-scanning), cs-10 (code-scanning), cs-9 (code-scanning), cs-8 (code-scanning), cs-7 (code-scanning), cs-6 (code-scanning), cs-5 (code-scanning), cs-4 (code-scanning), cs-3 (code-scanning), cs-2 (code-scanning), cs-1 (code-scanning)

🔄 Dependabot Alert Changes

Added: CVE-2024-47764 (low), CVE-2026-69112 (medium)

🔄 Dependabot Alert Changes

Resolved: CVE-2024-47764

✅ All Dependabot alerts have been resolved and no code/secret scanning alerts remain. Closing this issue.

Navigation Menu

Repository navigation

🔒 [IBM OSPO Security Notification] — IBM/CodeEngine #488