🔒 [IBM OSPO Security Notification] — IBM/algorithm-nexus

Chiusa
  • Qualcosa non va?
#340 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
security

Direzione di ricerca

The alert is for the vllm dependency, which must be raised from below 0.32.0 to 0.32.0. Start by finding where vllm is pinned or constrained in the Python packaging metadata, and check that the other packages in this distribution still resolve against the new version. Done means the vllm constraint is updated, the dependency set installs cleanly, and the Dependabot alert for CVE-2026-94624 is closed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

security

🔒 [IBM OSPO Security Notification] — IBM/algorithm-nexus

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @AlessandroPomponio @christian-pinto @michael-johnston @DRL-NextGen

Dependabot Alerts
Severity CVE/GHSA Package Affected Patched Deadline Fix PR
🟠 high CVE-2026-115912 vllm < 0.32.0 0.32.0 2026-12-04 —
🟠 high CVE-2026-115915 vllm < 0.32.0 0.32.0 2026-12-04 —
🟡 medium CVE-2026-94624 vllm < 0.32.0 0.32.0 2027-01-31 —
🟡 medium CVE-2026-115911 vllm >= 0.19.0, < 0.32.0 0.32.0 2027-02-02 —
🟡 medium CVE-2026-115918 vllm >= 0.16.0, < 0.32.0 0.32.0 2027-02-02 —
🟡 medium CVE-2026-115914 vllm >= 0.11.1, < 0.32.0 0.32.0 2027-02-02 —
🟡 medium CVE-2026-115916 vllm < 0.32.0 0.32.0 2027-02-02 —
🟡 medium CVE-2026-115913 vllm < 0.32.0 0.32.0 2027-02-02 —
Code Scanning Alerts

No open code scanning alerts.

Secret Scanning Alerts

No open secret scanning alerts.

Lingua principale
Python
Stelle
4
Fork
8
Merge medio
16h 42m
PR unite (30g)
23

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di IBM/algorithm-nexus

Tutte le issue di IBM/algorithm-nexus

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.