🔒 [IBM OSPO Security Notification] — IBM/cpex-plugins

Open Beginner friendly
#185 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
security

Research direction

Locate the dependency manifest or lockfile that declares anyio and inspect how it is used. Update anyio to version 4.14.2, run the repository's available tests, and verify that all listed Dependabot alerts are resolved so the issue can close automatically.

Written by the indexing model from the issue text.

Description

security

🔒 [IBM OSPO Security Notification] — IBM/cpex-plugins

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @jonpspri @ja8zyjits @brian-hussey

Dependabot Alerts
Severity CVE/GHSA Package Affected Patched Deadline Fix PR
🔴 critical CVE-2026-63374 anyio < 4.14.2 4.14.2 2026-09-26
🟠 high CVE-2026-63349 anyio >= 4.14.0, < 4.14.2 4.14.2 2026-10-19
🟡 medium CVE-2026-64847 anyio < 4.14.2 4.14.2 2026-12-18
Code Scanning Alerts

No open code scanning alerts.

Secret Scanning Alerts

No open secret scanning alerts.


Dominant language
Rust
Stars
10
Forks
1
Avg merge
3d 19h
Merged PRs (30d)
7

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from IBM/cpex-plugins

All issues in IBM/cpex-plugins

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.