Skip to content
This repository was archived by the owner on Oct 29, 2026. It is now read-only.
This repository was archived by the owner on Oct 29, 2026. It is now read-only.

🔒 [IBM OSPO Security Notification] — IBM/chuk-llm #49

Open
Open
🔒 [IBM OSPO Security Notification] — IBM/chuk-llm#49
Labels
security

Description

@security-ops-bot
security-ops-bot
bot
opened on Sep 29, 2026

🔒 [IBM OSPO Security Notification] — IBM/chuk-llm

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @chrishayuk

Dependabot Alerts

Severity CVE/GHSA Package Affected Patched Deadline Fix PR
🔴 critical CVE-2026-96639 Pillow >= 11.0.0, < 13.0.0 13.0.0 2026-11-04 —
🔴 critical CVE-2026-112398 pillow <= 12.3.0 13.0.0 2026-11-02 PR
🟠 high CVE-2026-96637 pillow < 13.0.0 13.0.0 2026-11-27 PR
🟠 high CVE-2026-96640 Pillow >= 5.1.0, < 13.0.0 13.0.0 2026-11-27 —
🟠 high CVE-2026-96642 Pillow < 13.0.0 13.0.0 2026-11-27 —
🟠 high CVE-2026-96643 Pillow >= 11.0.0, < 13.0.0 13.0.0 2026-11-27 —
🟠 high CVE-2026-96644 Pillow < 13.0.0 13.0.0 2026-11-27 —
🟠 high CVE-2026-96778 Pillow >= 9.4.0, < 13.0.0 13.0.0 2026-11-27 —
🟠 high CVE-2026-114134 black < 26.10.1 26.10.1 2026-11-27 PR
🟠 high GHSA-78g4-xqwv-q3g8 pillow >= 11.1.0, < 13.0.0 13.0.0 2026-11-27 PR
🟠 high CVE-2026-112940 filelock >= 3.20.4, <= 4.2.0 4.2.1 2026-11-25 PR
🟠 high CVE-2026-113723 virtualenv < 21.14.9 21.14.9 2026-11-25 PR
🟠 high CVE-2026-113718 virtualenv < 21.14.9 21.14.9 2026-11-25 PR
🟡 medium CVE-2026-96636 Pillow < 13.0.0 13.0.0 2027-01-26 —
🟡 medium CVE-2026-96638 pillow >= 9.1.0, < 13.0.0 13.0.0 2027-01-26 PR
🟡 medium CVE-2026-96641 pillow < 13.0.0 13.0.0 2027-01-26 PR
🟡 medium CVE-2026-114603 opentelemetry-api <= 1.45.0 1.45.1 2027-01-26 PR
🟡 medium CVE-2026-113721 virtualenv < 21.14.9 21.14.9 2027-01-26 PR
🟡 medium CVE-2026-114501 Pillow >= 11.2.1, < 13.0.0 13.0.0 2027-01-24 —
🟡 medium CVE-2026-113719 virtualenv < 21.14.9 21.14.9 2027-01-24 PR
🟡 medium CVE-2026-113720 virtualenv < 21.14.9 21.14.9 2027-01-24 PR

Code Scanning Alerts

Severity Rule Tool Deadline
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟠 high py/clear-text-logging-sensitive-data CodeQL 2026-10-29
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28
🟡 medium py/incomplete-url-substring-sanitization CodeQL 2026-12-28

Secret Scanning Alerts

No open secret scanning alerts.

Activity

  1. security-ops-bot
    added
    security
    on Sep 29, 2026

  2. security-ops-bot commented on Oct 7, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 7, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-97688 (medium)

  3. security-ops-bot commented on Oct 8, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 8, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-102930 (high), CVE-2026-102938 (medium)

  4. security-ops-bot commented on Oct 9, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 9, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-102925 (high), CVE-2026-102937 (high)

  5. security-ops-bot commented on Oct 12, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 12, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-97689 (high)

  6. security-ops-bot commented on Oct 15, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 15, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-59881 (medium), CVE-2026-69243 (medium), CVE-2026-69244 (high), CVE-2026-69247 (high)

  7. security-ops-bot commented on Oct 16, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 16, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-59881, CVE-2026-69243, CVE-2026-69244, CVE-2026-69247

  8. security-ops-bot commented on Oct 19, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 19, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-59881 (medium), CVE-2026-69243 (medium), CVE-2026-69244 (high), CVE-2026-69247 (high)

  9. security-ops-bot commented on Oct 20, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 20, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-59881, CVE-2026-69243, CVE-2026-69244, CVE-2026-69247

  10. security-ops-bot commented on Oct 21, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 21, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-111064 (high), GHSA-2g87-pp6c-29x5 (high), CVE-2026-97687 (high), CVE-2026-104874 (medium)

  11. security-ops-bot commented on Oct 23, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 23, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-111750 (medium), CVE-2026-111065 (medium), CVE-2026-111748 (medium), CVE-2026-111066 (high), GHSA-6q48-6c7w-9gw2 (critical), CVE-2026-112403 (critical), CVE-2026-112404 (high), CVE-2026-112395 (medium), CVE-2026-112895 (high), CVE-2026-112896 (high), CVE-2026-112897 (high), CVE-2026-112899 (medium), CVE-2026-112400 (high), CVE-2026-112397 (high), CVE-2026-113776 (high), CVE-2026-113732 (high), CVE-2026-113726 (high), CVE-2026-113725 (high), CVE-2026-112900 (critical), CVE-2026-112394 (medium), CVE-2026-112402 (high), CVE-2026-112893 (high), CVE-2026-112405 (high), CVE-2026-112392 (high), CVE-2026-112891 (medium), CVE-2026-112390 (high), CVE-2026-112401 (medium), CVE-2026-112898 (medium), CVE-2026-112901 (medium), CVE-2026-112391 (medium), CVE-2026-112894 (high), CVE-2026-112892 (high), CVE-2026-112399 (high), CVE-2026-112406 (high), CVE-2026-112396 (medium), CVE-2026-112393 (critical), CVE-2026-112902 (high), CVE-2026-113722 (high), CVE-2026-113724 (medium), CVE-2026-113716 (medium), CVE-2026-96636 (medium), CVE-2026-96637 (high), CVE-2026-96638 (medium), CVE-2026-96639 (critical), CVE-2026-96640 (high), CVE-2026-96641 (medium), CVE-2026-96642 (high), CVE-2026-96643 (high)

  12. security-ops-bot commented on Oct 26, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 26, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-114501 (medium), CVE-2026-112398 (critical), CVE-2026-112940 (high), CVE-2026-113719 (medium), CVE-2026-113723 (high), CVE-2026-113720 (medium), CVE-2026-113718 (high)

    Resolved: CVE-2026-97688, CVE-2026-102930, CVE-2026-102938, CVE-2026-102925, CVE-2026-102937, CVE-2026-97689, CVE-2026-111064, GHSA-2g87-pp6c-29x5, CVE-2026-97687, CVE-2026-104874, CVE-2026-111750, CVE-2026-111065, CVE-2026-111748, CVE-2026-111066, GHSA-6q48-6c7w-9gw2, CVE-2026-112403, CVE-2026-112404, CVE-2026-112395, CVE-2026-112895, CVE-2026-112896, CVE-2026-112897, CVE-2026-112899, CVE-2026-112400, CVE-2026-112397, CVE-2026-113776, CVE-2026-113732, CVE-2026-113726, CVE-2026-113725, CVE-2026-112900, CVE-2026-112394, CVE-2026-112402, CVE-2026-112893, CVE-2026-112405, CVE-2026-112392, CVE-2026-112891, CVE-2026-112390, CVE-2026-112401, CVE-2026-112898, CVE-2026-112901, CVE-2026-112391, CVE-2026-112894, CVE-2026-112892, CVE-2026-112399, CVE-2026-112406, CVE-2026-112396, CVE-2026-112393, CVE-2026-112902, CVE-2026-113722, CVE-2026-113724, CVE-2026-113716, CVE-2026-96636, CVE-2026-96637, CVE-2026-96638, CVE-2026-96639, CVE-2026-96640, CVE-2026-96641, CVE-2026-96642, CVE-2026-96643

  13. security-ops-bot commented on Oct 26, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 26, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/chuk-llm

    The following 30 alerts are approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    cs-30 high 2026-10-29
    cs-29 high 2026-10-29
    cs-28 high 2026-10-29
    cs-27 high 2026-10-29
    cs-26 high 2026-10-29
    cs-25 high 2026-10-29
    cs-24 high 2026-10-29
    cs-23 high 2026-10-29
    cs-22 high 2026-10-29
    cs-21 high 2026-10-29
    cs-20 high 2026-10-29
    cs-19 high 2026-10-29
    cs-18 high 2026-10-29
    cs-17 high 2026-10-29
    cs-16 high 2026-10-29
    cs-15 high 2026-10-29
    cs-14 high 2026-10-29
    cs-13 high 2026-10-29
    cs-12 high 2026-10-29
    cs-11 high 2026-10-29
    cs-10 high 2026-10-29
    cs-9 high 2026-10-29
    cs-8 high 2026-10-29
    cs-7 high 2026-10-29
    cs-6 high 2026-10-29
    cs-5 high 2026-10-29
    cs-4 high 2026-10-29
    cs-3 high 2026-10-29
    cs-2 high 2026-10-29
    cs-1 high 2026-10-29

    @chrishayuk

  14. security-ops-bot commented on Oct 28, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 28, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-96636 (medium), CVE-2026-96637 (high), CVE-2026-96638 (medium), CVE-2026-96639 (critical), CVE-2026-96640 (high), CVE-2026-96641 (medium), CVE-2026-96642 (high), CVE-2026-96643 (high), CVE-2026-96644 (high), CVE-2026-96778 (high), CVE-2026-114134 (high), CVE-2026-114603 (medium), GHSA-78g4-xqwv-q3g8 (high), CVE-2026-113721 (medium)

  15. security-ops-bot commented on Oct 28, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 28, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/chuk-llm

    The following 30 alerts are approaching their SLA deadline with 1 day remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    cs-30 high 2026-10-29
    cs-29 high 2026-10-29
    cs-28 high 2026-10-29
    cs-27 high 2026-10-29
    cs-26 high 2026-10-29
    cs-25 high 2026-10-29
    cs-24 high 2026-10-29
    cs-23 high 2026-10-29
    cs-22 high 2026-10-29
    cs-21 high 2026-10-29
    cs-20 high 2026-10-29
    cs-19 high 2026-10-29
    cs-18 high 2026-10-29
    cs-17 high 2026-10-29
    cs-16 high 2026-10-29
    cs-15 high 2026-10-29
    cs-14 high 2026-10-29
    cs-13 high 2026-10-29
    cs-12 high 2026-10-29
    cs-11 high 2026-10-29
    cs-10 high 2026-10-29
    cs-9 high 2026-10-29
    cs-8 high 2026-10-29
    cs-7 high 2026-10-29
    cs-6 high 2026-10-29
    cs-5 high 2026-10-29
    cs-4 high 2026-10-29
    cs-3 high 2026-10-29
    cs-2 high 2026-10-29
    cs-1 high 2026-10-29

    @chrishayuk

  16. security-ops-bot commented on Oct 29, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 29, 2026 – with security-ops-bot
    Author

    🔒 Repository Archived — IBM/chuk-llm

    The following 30 alerts have exceeded their SLA deadline without being remediated. This repository has been archived.

    Alert Severity Deadline
    cs-30 high 2026-10-29
    cs-29 high 2026-10-29
    cs-28 high 2026-10-29
    cs-27 high 2026-10-29
    cs-26 high 2026-10-29
    cs-25 high 2026-10-29
    cs-24 high 2026-10-29
    cs-23 high 2026-10-29
    cs-22 high 2026-10-29
    cs-21 high 2026-10-29
    cs-20 high 2026-10-29
    cs-19 high 2026-10-29
    cs-18 high 2026-10-29
    cs-17 high 2026-10-29
    cs-16 high 2026-10-29
    cs-15 high 2026-10-29
    cs-14 high 2026-10-29
    cs-13 high 2026-10-29
    cs-12 high 2026-10-29
    cs-11 high 2026-10-29
    cs-10 high 2026-10-29
    cs-9 high 2026-10-29
    cs-8 high 2026-10-29
    cs-7 high 2026-10-29
    cs-6 high 2026-10-29
    cs-5 high 2026-10-29
    cs-4 high 2026-10-29
    cs-3 high 2026-10-29
    cs-2 high 2026-10-29
    cs-1 high 2026-10-29

    To request unarchiving, contact your security team and provide a remediation plan.

    @chrishayuk

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    security

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions