🔒 Security Alerts — IBM/DeepRest

## 🔒 Security Alerts — IBM/DeepRest

> **Action required:** Remediate the alerts listed below before their SLA deadline.
> This issue will be closed automatically once all alerts are resolved.
>
> **SLA policy:** critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
> Alerts at or above medium severity will trigger a warning comment before the deadline and
> repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
> they will never trigger warnings or archiving.
>
> 💡 **Tip:** To have Dependabot automatically open fix PRs for dependency alerts, enable
> **Dependabot security updates** in your repo settings:
> Settings → Advanced Security → Dependabot security updates → Enable.
>
> 📖 **New to this issue?** See the [Security Issue Guide](https://ibm.github.io/security-ops-bot/security-issue-guide.html#what-you-should-do) for a full explanation of what this issue means and what you need to do.

Attention: _(no direct admin collaborators assigned to this repo — please add an admin to receive security notifications)_

### Dependabot Alerts

| Severity | CVE/GHSA | Package | Affected | Patched | Fix PR |
|---|---|---|---|---|---|
| 🔴 critical | CVE-2026-39830 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🔴 critical | CVE-2026-39831 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🔴 critical | CVE-2026-39834 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🔴 critical | CVE-2026-42508 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🔴 critical | CVE-2026-39832 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🔴 critical | CVE-2026-46595 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🔴 critical | CVE-2026-39833 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🟠 high | CVE-2026-46597 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🟠 high | CVE-2026-39829 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🟠 high | CVE-2026-13149 | brace-expansion | < 1.1.16 | 1.1.16 | — |
| 🟠 high | CVE-2026-59869 | js-yaml | >= 3.0.0, < 3.15.0 | 3.15.0 | — |
| 🟠 high | CVE-2026-45623 | postcss | <= 8.5.11 | 8.5.12 | — |
| 🟠 high | CVE-2026-73646 | postcss | <= 8.5.17 | 8.5.18 | — |
| 🟠 high | GHSA-5p4m-2wfm-xmqj | js-yaml | >= 3.0.0, < 3.15.1 | 3.15.1 | — |
| 🟠 high | CVE-2026-73088 | browserslist | <= 4.28.6 | 4.28.7 | — |
| 🟠 high | CVE-2026-84375 | js-yaml | >= 3.0.0, < 3.15.2 | 3.15.2 | — |
| 🟡 medium | CVE-2026-53655 | tar | <= 7.5.15 | 7.5.16 | — |
| 🟡 medium | CVE-2026-53550 | js-yaml | < 3.15.0 | 3.15.0 | — |
| 🟡 medium | CVE-2021-25736 | k8s.io/kubernetes | < 1.21.0 | 1.21.0 | — |
| 🟡 medium | CVE-2026-39835 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🟡 medium | CVE-2026-39828 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🟡 medium | CVE-2026-39827 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🟡 medium | CVE-2026-46598 | golang.org/x/crypto | < 0.52.0 | 0.52.0 | — |
| 🟡 medium | CVE-2026-59871 | tar | <= 7.5.17 | 7.5.18 | — |
| 🟡 medium | CVE-2026-69153 | postcss | <= 8.5.22 | 8.5.23 | — |
| 🟡 medium | CVE-2026-45822 | decode-uri-component | <= 0.4.2 | 0.5.0 | — |

### Code Scanning Alerts

_No open code scanning alerts._


### Secret Scanning Alerts

_No open secret scanning alerts._

---

Navigation Menu

Uh oh!

🔒 Security Alerts — IBM/DeepRest #6