Skip to content

🔒 [IBM OSPO Security Notification] — IBM/chuk-llm #49

Open
Open
🔒 [IBM OSPO Security Notification] — IBM/chuk-llm#49
Labels
security

Description

@security-ops-bot
security-ops-bot
bot
opened on Sep 29, 2026

🔒 [IBM OSPO Security Notification] — IBM/chuk-llm

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @chrishayuk

Dependabot Alerts

Severity CVE/GHSA Package Affected Patched Deadline Fix PR
🔴 critical CVE-2026-112398 pillow <= 12.3.0 13.0.0 2026-11-02 PR
🟠 high CVE-2026-112940 filelock >= 3.20.4, <= 4.2.0 4.2.1 2026-11-25 PR
🟠 high CVE-2026-113723 virtualenv < 21.14.9 21.14.9 2026-11-25 PR
🟠 high CVE-2026-113718 virtualenv < 21.14.9 21.14.9 2026-11-25 PR
🟡 medium CVE-2026-114501 Pillow >= 11.2.1, < 13.0.0 13.0.0 2027-01-24 —
🟡 medium CVE-2026-113719 virtualenv < 21.14.9 21.14.9 2027-01-24 PR
🟡 medium CVE-2026-113720 virtualenv < 21.14.9 21.14.9 2027-01-24 PR

Code Scanning Alerts

Severity Rule Tool Deadline
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28
🟡 medium py/incomplete-url-substring-sanitization CodeQL 2026-12-28

Secret Scanning Alerts

No open secret scanning alerts.

Activity

  1. security-ops-bot
    added
    security
    on Sep 29, 2026

  2. security-ops-bot commented on Oct 7, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 7, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-97688 (medium)

  3. security-ops-bot commented on Oct 8, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 8, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-102930 (high), CVE-2026-102938 (medium)

  4. security-ops-bot commented on Oct 9, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 9, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-102925 (high), CVE-2026-102937 (high)

  5. security-ops-bot commented on Oct 12, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 12, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-97689 (high)

  6. security-ops-bot commented on Oct 15, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 15, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-59881 (medium), CVE-2026-69243 (medium), CVE-2026-69244 (high), CVE-2026-69247 (high)

  7. security-ops-bot commented on Oct 16, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 16, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-59881, CVE-2026-69243, CVE-2026-69244, CVE-2026-69247

  8. security-ops-bot commented on Oct 19, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 19, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-59881 (medium), CVE-2026-69243 (medium), CVE-2026-69244 (high), CVE-2026-69247 (high)

  9. security-ops-bot commented on Oct 20, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 20, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-59881, CVE-2026-69243, CVE-2026-69244, CVE-2026-69247

  10. security-ops-bot commented on Oct 21, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 21, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-111064 (high), GHSA-2g87-pp6c-29x5 (high), CVE-2026-97687 (high), CVE-2026-104874 (medium)

  11. security-ops-bot commented on Oct 23, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 23, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-111750 (medium), CVE-2026-111065 (medium), CVE-2026-111748 (medium), CVE-2026-111066 (high), GHSA-6q48-6c7w-9gw2 (critical), CVE-2026-112403 (critical), CVE-2026-112404 (high), CVE-2026-112395 (medium), CVE-2026-112895 (high), CVE-2026-112896 (high), CVE-2026-112897 (high), CVE-2026-112899 (medium), CVE-2026-112400 (high), CVE-2026-112397 (high), CVE-2026-113776 (high), CVE-2026-113732 (high), CVE-2026-113726 (high), CVE-2026-113725 (high), CVE-2026-112900 (critical), CVE-2026-112394 (medium), CVE-2026-112402 (high), CVE-2026-112893 (high), CVE-2026-112405 (high), CVE-2026-112392 (high), CVE-2026-112891 (medium), CVE-2026-112390 (high), CVE-2026-112401 (medium), CVE-2026-112898 (medium), CVE-2026-112901 (medium), CVE-2026-112391 (medium), CVE-2026-112894 (high), CVE-2026-112892 (high), CVE-2026-112399 (high), CVE-2026-112406 (high), CVE-2026-112396 (medium), CVE-2026-112393 (critical), CVE-2026-112902 (high), CVE-2026-113722 (high), CVE-2026-113724 (medium), CVE-2026-113716 (medium), CVE-2026-96636 (medium), CVE-2026-96637 (high), CVE-2026-96638 (medium), CVE-2026-96639 (critical), CVE-2026-96640 (high), CVE-2026-96641 (medium), CVE-2026-96642 (high), CVE-2026-96643 (high)

  12. security-ops-bot commented on Oct 26, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 26, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-114501 (medium), CVE-2026-112398 (critical), CVE-2026-112940 (high), CVE-2026-113719 (medium), CVE-2026-113723 (high), CVE-2026-113720 (medium), CVE-2026-113718 (high)

    Resolved: CVE-2026-97688, CVE-2026-102930, CVE-2026-102938, CVE-2026-102925, CVE-2026-102937, CVE-2026-97689, CVE-2026-111064, GHSA-2g87-pp6c-29x5, CVE-2026-97687, CVE-2026-104874, CVE-2026-111750, CVE-2026-111065, CVE-2026-111748, CVE-2026-111066, GHSA-6q48-6c7w-9gw2, CVE-2026-112403, CVE-2026-112404, CVE-2026-112395, CVE-2026-112895, CVE-2026-112896, CVE-2026-112897, CVE-2026-112899, CVE-2026-112400, CVE-2026-112397, CVE-2026-113776, CVE-2026-113732, CVE-2026-113726, CVE-2026-113725, CVE-2026-112900, CVE-2026-112394, CVE-2026-112402, CVE-2026-112893, CVE-2026-112405, CVE-2026-112392, CVE-2026-112891, CVE-2026-112390, CVE-2026-112401, CVE-2026-112898, CVE-2026-112901, CVE-2026-112391, CVE-2026-112894, CVE-2026-112892, CVE-2026-112399, CVE-2026-112406, CVE-2026-112396, CVE-2026-112393, CVE-2026-112902, CVE-2026-113722, CVE-2026-113724, CVE-2026-113716, CVE-2026-96636, CVE-2026-96637, CVE-2026-96638, CVE-2026-96639, CVE-2026-96640, CVE-2026-96641, CVE-2026-96642, CVE-2026-96643

  13. security-ops-bot commented on Oct 26, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 26, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/chuk-llm

    The following 30 alerts are approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    cs-30 high 2026-10-29
    cs-29 high 2026-10-29
    cs-28 high 2026-10-29
    cs-27 high 2026-10-29
    cs-26 high 2026-10-29
    cs-25 high 2026-10-29
    cs-24 high 2026-10-29
    cs-23 high 2026-10-29
    cs-22 high 2026-10-29
    cs-21 high 2026-10-29
    cs-20 high 2026-10-29
    cs-19 high 2026-10-29
    cs-18 high 2026-10-29
    cs-17 high 2026-10-29
    cs-16 high 2026-10-29
    cs-15 high 2026-10-29
    cs-14 high 2026-10-29
    cs-13 high 2026-10-29
    cs-12 high 2026-10-29
    cs-11 high 2026-10-29
    cs-10 high 2026-10-29
    cs-9 high 2026-10-29
    cs-8 high 2026-10-29
    cs-7 high 2026-10-29
    cs-6 high 2026-10-29
    cs-5 high 2026-10-29
    cs-4 high 2026-10-29
    cs-3 high 2026-10-29
    cs-2 high 2026-10-29
    cs-1 high 2026-10-29

    @chrishayuk

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    security

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions