🔒 [IBM OSPO Security Notification] — IBM/simrun
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 30/100
调研方向
The issue lists multiple dependency vulnerabilities with deadlines. Check the project's dependency files (like go.mod, package.json, or lockfiles) to see current versions. For vite and postcss, a fix PR #70 exists; review it to understand the update. For docker and other packages, check if updates are available. Running dependency audits and tests after updates is needed to confirm resolution.
由索引模型根据 Issue 内容生成。
描述
🔒 [IBM OSPO Security Notification] — IBM/simrun
Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.
Attention: @faloker
Dependabot Alerts
| Severity | CVE/GHSA | Package | Affected | Patched | Deadline | Fix PR |
|---|---|---|---|---|---|---|
| 🟠 high | CVE-2026-41567 | github.com/docker/docker | <= 28.5.2 | — | 2026-11-20 | — |
| 🟠 high | CVE-2026-42306 | github.com/docker/docker | <= 28.5.2 | — | 2026-11-20 | — |
| 🟠 high | CVE-2026-53571 | vite | >= 8.0.0, <= 8.0.15 | 8.0.16 | 2026-11-20 | — |
| 🟠 high | CVE-2026-73646 | postcss | <= 8.5.17 | 8.5.18 | 2026-11-20 | — |
| 🟠 high | CVE-2026-92708 | devalue | >= 5.1.0, <= 5.9.2 | 5.9.3 | 2026-11-20 | — |
| 🟠 high | CVE-2026-93749 | source-map-js | >= 1.0.0, < 1.2.2 | 1.2.2 | 2026-11-18 | — |
| 🟠 high | GHSA-r9w8-h9r3-54w4 | devalue | <= 5.9.2 | 5.9.3 | 2026-11-19 | — |
| 🟠 high | CVE-2026-112942 | vite | >= 8.0.0, <= 8.1.5 | 8.1.6 | 2026-11-21 | — |
| 🟡 medium | CVE-2026-33997 | github.com/docker/docker | < 29.3.1 | — | 2027-01-19 | — |
| 🟡 medium | CVE-2026-41568 | github.com/docker/docker | <= 28.5.2 | — | 2027-01-19 | — |
| 🟡 medium | CVE-2026-53632 | vite | >= 8.0.0, <= 8.0.15 | 8.0.16 | 2027-01-19 | — |
| 🟡 medium | GHSA-866w-xmhq-wj7x | @sveltejs/kit | <= 2.69.0 | 2.69.1 | 2027-01-19 | — |
| 🟡 medium | CVE-2026-69153 | postcss | <= 8.5.22 | 8.5.23 | 2027-01-19 | — |
| 🟡 medium | GHSA-4q55-j62x-fr9h | devalue | <= 5.9.2 | 5.9.3 | 2027-01-19 | — |
| 🟡 medium | GHSA-hx4r-w6wj-j8fg | devalue | <= 5.9.2 | 5.9.3 | 2027-01-19 | — |
| 🟡 medium | CVE-2026-112943 | vite | >= 8.0.0, <= 8.1.5 | 8.1.6 | 2027-01-20 | — |
| 🟡 medium | CVE-2026-112944 | vite | >= 8.0.0, <= 8.1.5 | 8.1.6 | 2027-01-20 | — |
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.
- 主要语言
- Go
- 星标
- 11
- 派生
- 1
- 平均合并
- 23 分钟
- 30 天内合并 PR
- 1
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
IBM/simrun 的其他 Issue
相似的 Issue
-
native
难度 2/5 1-3 小时 新手友好度 72/100
prime-radiant-inc/evener#4839 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 85/100
521xueweihan/HelloGitHub#4073 ·
-
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 66/100
goharbor/terraform-provider-harbor#655 · 1 条评论 ·