🔒 [IBM OSPO Security Notification] — IBM/plex
Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.
SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.
💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.
📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.
Attention: @jeffchew @sstrubberg @ibmdotcom-bot @Palke @Lingaraj-13 @stephharrington1 @Dan-Pastrolin-IBM @leonardo-costa-IBM @rsebade-ibm
Dependabot Alerts
| Severity |
CVE/GHSA |
Package |
Affected |
Patched |
Deadline |
Fix PR |
| 🔴 critical |
CVE-2026-33937 |
handlebars |
>= 4.0.0, <= 4.7.8 |
4.7.9 |
2026-09-24 |
— |
| 🟠 high |
CVE-2025-64756 |
glob |
>= 10.2.0, < 10.5.0 |
10.5.0 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-26996 |
minimatch |
>= 9.0.0, < 9.0.6 |
9.0.6 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-27904 |
minimatch |
>= 9.0.0, < 9.0.7 |
9.0.7 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-27903 |
minimatch |
>= 8.0.0, < 8.0.6 |
8.0.6 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-33938 |
handlebars |
>= 4.0.0, <= 4.7.8 |
4.7.9 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-33940 |
handlebars |
>= 4.0.0, <= 4.7.8 |
4.7.9 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-33941 |
handlebars |
>= 4.0.0, <= 4.7.8 |
4.7.9 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-46625 |
js-cookie |
<= 3.0.5 |
3.0.7 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-48815 |
sigstore |
<= 4.1.0 |
4.1.1 |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-56876 |
extract-zip |
<= 2.0.1 |
— |
2026-10-17 |
— |
| 🟠 high |
CVE-2026-19693 |
extract-zip |
<= 2.0.1 |
— |
2026-10-17 |
— |
| 🟡 medium |
CVE-2026-33672 |
picomatch |
< 2.3.2 |
2.3.2 |
2026-12-16 |
— |
| 🟡 medium |
CVE-2026-33916 |
handlebars |
>= 4.0.0, < 4.7.9 |
4.7.9 |
2026-12-16 |
— |
| 🟡 medium |
GHSA-7rx3-28cr-v5wh |
handlebars |
>= 4.6.0, <= 4.7.8 |
4.7.9 |
2026-12-16 |
— |
| 🟡 medium |
CVE-2026-41907 |
uuid |
< 11.1.1 |
11.1.1 |
2026-12-16 |
— |
| 🟡 medium |
CVE-2026-48758 |
@sigstore/core |
<= 3.2.0 |
3.2.1 |
2026-12-16 |
— |
| 🟡 medium |
CVE-2026-54753 |
nx |
>= 17.0.4, < 22.7.2 |
22.7.2 |
2026-12-16 |
— |
| 🔵 low |
GHSA-442j-39wm-28r2 |
handlebars |
>= 4.0.0, <= 4.7.8 |
4.7.9 |
— |
— |
| 🔵 low |
CVE-2026-3449 |
@tootallnate/once |
< 2.0.1 |
2.0.1 |
— |
— |
| 🔵 low |
CVE-2026-84367 |
joi |
>= 16.0.0, < 17.13.5 |
17.13.5 |
— |
— |
| 🔵 low |
CVE-2026-84368 |
joi |
>= 17.2.0, < 17.13.6 |
17.13.6 |
— |
— |
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.
🔒 [IBM OSPO Security Notification] — IBM/plex
Attention: @jeffchew @sstrubberg @ibmdotcom-bot @Palke @Lingaraj-13 @stephharrington1 @Dan-Pastrolin-IBM @leonardo-costa-IBM @rsebade-ibm
Dependabot Alerts
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.