🔒 [IBM OSPO Security Notification] — IBM/text-generation-inference

[security-ops-bot]

🔒 [IBM OSPO Security Notification] — IBM/text-generation-inference

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

Attention: @joerunde @Nhan-Hoang

Dependabot Alerts

Severity	CVE/GHSA	Package	Affected	Patched	Deadline	Fix PR
🟠 high	CVE-2026-69249	cryptography	>= 42.0.0, < 49.0.0	49.0.0	2026-10-10	—
🟡 medium	CVE-2026-69112	accelerate	<= 1.14.0	—	2026-12-09	—

Code Scanning Alerts

Severity	Rule	Tool	Deadline
🟡 medium	actions/missing-workflow-permissions	CodeQL	2026-12-08
🟡 medium	actions/missing-workflow-permissions	CodeQL	2026-12-08

Secret Scanning Alerts

No open secret scanning alerts.

---

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-1839 (medium), CVE-2025-71176 (medium), GHSA-965h-392x-2mh5 (low), GHSA-xgp8-3hg3-c2mh (low), GHSA-cq8v-f236-94qc (low), CVE-2026-41681 (high), CVE-2026-41898 (high), CVE-2026-41678 (high), CVE-2026-41677 (low), CVE-2026-41676 (high), GHSA-82j2-j2ch-gfr8 (high), CVE-2026-42327 (high), CVE-2026-44662 (medium), CVE-2026-44431 (high), CVE-2026-45409 (medium), CVE-2026-45784 (medium), CVE-2026-34993 (medium), CVE-2026-47265 (medium), CVE-2026-25087 (high), CVE-2025-2148 (low), CVE-2025-2998 (medium), CVE-2025-2149 (low), CVE-2025-2999 (medium), CVE-2025-3001 (low), CVE-2026-50269 (low), CVE-2026-54278 (medium), CVE-2026-54279 (low), CVE-2026-54277 (medium), CVE-2026-54273 (medium), CVE-2026-54280 (low), CVE-2026-54276 (medium), CVE-2026-54274 (medium), CVE-2026-54275 (low), GHSA-537c-gmf6-5ccf (high), CVE-2026-48504 (medium), CVE-2026-4372 (high), CVE-2026-44512 (medium), CVE-2026-5241 (high), CVE-2025-3000 (low), CVE-2026-59890 (medium), CVE-2026-63632 (low), CVE-2026-59881 (medium), CVE-2026-69243 (medium), CVE-2026-69244 (high), CVE-2026-69247 (high), CVE-2026-9856 (high), CVE-2026-69249 (high), CVE-2026-69112 (medium)

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: GHSA-vw5v-4f2q-w9xf (high), GHSA-65p9-r9h6-22vj (high), GHSA-hfpc-8r3f-gw53 (high), GHSA-9f94-5g5w-gf6r (high), CVE-2026-28500 (high), GHSA-pwjx-qhcg-rvj4 (medium), CVE-2026-25645 (medium), CVE-2026-34073 (low), CVE-2026-4539 (low), CVE-2026-27489 (high), CVE-2026-22815 (medium), CVE-2026-34445 (high), CVE-2026-34446 (medium), CVE-2026-34447 (medium), CVE-2026-34513 (low), CVE-2026-34514 (low), CVE-2026-34515 (medium), CVE-2026-34516 (medium), CVE-2026-34517 (low), CVE-2026-34518 (low), CVE-2026-34519 (low), CVE-2026-34520 (low), CVE-2026-34525 (medium), CVE-2026-49114 (high)

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: GHSA-vw5v-4f2q-w9xf, GHSA-65p9-r9h6-22vj, GHSA-hfpc-8r3f-gw53, GHSA-9f94-5g5w-gf6r, CVE-2026-28500, GHSA-pwjx-qhcg-rvj4, CVE-2026-25645, CVE-2026-34073, CVE-2026-4539, CVE-2026-27489, CVE-2026-22815, CVE-2026-34445, CVE-2026-34446, CVE-2026-34447, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-49114, CVE-2026-1839, CVE-2025-71176, GHSA-965h-392x-2mh5, GHSA-xgp8-3hg3-c2mh, GHSA-cq8v-f236-94qc, CVE-2026-41681, CVE-2026-41898, CVE-2026-41678, CVE-2026-41677, CVE-2026-41676, GHSA-82j2-j2ch-gfr8, CVE-2026-42327, CVE-2026-44662, CVE-2026-44431, CVE-2026-45409, CVE-2026-45784, CVE-2026-34993, CVE-2026-47265, CVE-2026-25087, CVE-2025-2148, CVE-2025-2998, CVE-2025-2149, CVE-2025-2999, CVE-2025-3001, CVE-2026-50269, CVE-2026-54278, CVE-2026-54279, CVE-2026-54277, CVE-2026-54273, CVE-2026-54280, CVE-2026-54276, CVE-2026-54274, CVE-2026-54275, GHSA-537c-gmf6-5ccf, CVE-2026-48504, CVE-2026-4372, CVE-2026-44512, CVE-2026-5241, CVE-2025-3000, CVE-2026-59890

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-1839 (medium), CVE-2025-71176 (medium), GHSA-965h-392x-2mh5 (low), GHSA-xgp8-3hg3-c2mh (low), GHSA-cq8v-f236-94qc (low), CVE-2026-41681 (high), CVE-2026-41898 (high), CVE-2026-41678 (high), CVE-2026-41677 (low), CVE-2026-41676 (high), GHSA-82j2-j2ch-gfr8 (high), CVE-2026-42327 (high), CVE-2026-44662 (medium), CVE-2026-44431 (high), CVE-2026-45409 (medium), CVE-2026-45784 (medium), CVE-2026-34993 (medium), CVE-2026-47265 (medium), CVE-2026-25087 (high), CVE-2025-2148 (low), CVE-2025-2998 (medium), CVE-2025-2149 (low), CVE-2025-2999 (medium), CVE-2025-3001 (low), CVE-2026-50269 (low), CVE-2026-54278 (medium), CVE-2026-54279 (low), CVE-2026-54277 (medium), CVE-2026-54273 (medium), CVE-2026-54280 (low), CVE-2026-54276 (medium), CVE-2026-54274 (medium), CVE-2026-54275 (low), GHSA-537c-gmf6-5ccf (high), CVE-2026-48504 (medium), CVE-2026-4372 (high), CVE-2026-44512 (medium), CVE-2026-5241 (high), CVE-2025-3000 (low), CVE-2026-59890 (medium)

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2024-11392 (high), CVE-2024-11394 (high), CVE-2024-11393 (high), CVE-2024-12720 (medium), CVE-2025-1194 (medium), CVE-2025-2099 (medium), CVE-2025-2953 (low), CVE-2024-47081 (medium), CVE-2025-4565 (high), CVE-2025-3730 (medium), CVE-2025-50181 (medium), CVE-2025-50182 (medium), CVE-2025-3263 (medium), CVE-2025-3264 (medium), CVE-2025-3777 (low), CVE-2025-3933 (medium), CVE-2025-53643 (low), CVE-2025-5197 (medium), CVE-2025-58160 (low), CVE-2025-32434 (critical), CVE-2025-6638 (medium), CVE-2025-6051 (medium), CVE-2025-6921 (medium), CVE-2025-66418 (high), CVE-2025-66471 (high)

Resolved: CVE-2026-1839, CVE-2025-71176, GHSA-965h-392x-2mh5, GHSA-xgp8-3hg3-c2mh, GHSA-cq8v-f236-94qc, CVE-2026-41681, CVE-2026-41898, CVE-2026-41678, CVE-2026-41677, CVE-2026-41676, GHSA-82j2-j2ch-gfr8, CVE-2026-42327, CVE-2026-44662, CVE-2026-44431, CVE-2026-45409, CVE-2026-45784, CVE-2026-34993, CVE-2026-47265, CVE-2026-25087, CVE-2025-2148, CVE-2025-2998, CVE-2025-2149, CVE-2025-2999, CVE-2025-3001, CVE-2026-50269, CVE-2026-54278, CVE-2026-54279, CVE-2026-54277, CVE-2026-54273, CVE-2026-54280, CVE-2026-54276, CVE-2026-54274, CVE-2026-54275, GHSA-537c-gmf6-5ccf, CVE-2026-48504, CVE-2026-4372, CVE-2026-44512, CVE-2026-5241, CVE-2025-3000, CVE-2026-59890, CVE-2026-63632

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2024-11392, CVE-2024-11394, CVE-2024-11393, CVE-2024-12720, CVE-2025-1194, CVE-2025-2099, CVE-2025-2953, CVE-2024-47081, CVE-2025-4565, CVE-2025-3730, CVE-2025-50181, CVE-2025-50182, CVE-2025-3263, CVE-2025-3264, CVE-2025-3777, CVE-2025-3933, CVE-2025-53643, CVE-2025-5197, CVE-2025-58160, CVE-2025-32434, CVE-2025-6638, CVE-2025-6051, CVE-2025-6921, CVE-2025-66418, CVE-2025-66471, CVE-2026-59881, CVE-2026-69243, CVE-2026-69244, CVE-2026-69247, CVE-2026-9856

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2024-11392 (high), CVE-2024-11394 (high), CVE-2024-11393 (high), CVE-2024-12720 (medium), CVE-2025-1194 (medium), CVE-2025-2099 (medium), CVE-2025-2953 (low), CVE-2024-47081 (medium), CVE-2025-4565 (high), CVE-2025-3730 (medium), CVE-2025-50181 (medium), CVE-2025-50182 (medium), CVE-2025-3263 (medium), CVE-2025-3264 (medium), CVE-2025-3777 (low), CVE-2025-3933 (medium), CVE-2025-53643 (low), CVE-2025-5197 (medium), CVE-2025-58160 (low), CVE-2025-32434 (critical), CVE-2025-6638 (medium), CVE-2025-6051 (medium), CVE-2025-6921 (medium), CVE-2025-66418 (high), CVE-2025-66471 (high), CVE-2026-59881 (medium), CVE-2026-69243 (medium), CVE-2026-69244 (high), CVE-2026-69247 (high), CVE-2026-9856 (high)

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-34073 (low), CVE-2026-4539 (low), CVE-2026-27489 (high), CVE-2026-22815 (medium), CVE-2026-34445 (high), CVE-2026-34446 (medium), CVE-2026-34447 (medium), CVE-2026-34513 (low), CVE-2026-34514 (low), CVE-2026-34515 (medium), CVE-2026-34516 (medium), CVE-2026-34517 (low), CVE-2026-34518 (low), CVE-2026-34519 (low), CVE-2026-34520 (low), CVE-2026-34525 (medium), CVE-2026-49114 (high), CVE-2026-1839 (medium), CVE-2025-71176 (medium), GHSA-965h-392x-2mh5 (low), GHSA-xgp8-3hg3-c2mh (low), GHSA-cq8v-f236-94qc (low), CVE-2026-41681 (high), CVE-2026-41898 (high), CVE-2026-41678 (high), CVE-2026-41677 (low), CVE-2026-41676 (high), GHSA-82j2-j2ch-gfr8 (high), CVE-2026-42327 (high), CVE-2026-44662 (medium), CVE-2026-44431 (high), CVE-2026-45409 (medium), CVE-2026-45784 (medium), CVE-2026-34993 (medium), CVE-2026-47265 (medium), CVE-2026-25087 (high), CVE-2025-2148 (low), CVE-2025-2998 (medium), CVE-2025-2149 (low), CVE-2025-2999 (medium), CVE-2025-3001 (low), CVE-2026-50269 (low), CVE-2026-54278 (medium), CVE-2026-54279 (low), CVE-2026-54277 (medium), CVE-2026-54273 (medium), CVE-2026-54280 (low), CVE-2026-54276 (medium), CVE-2026-54274 (medium), CVE-2026-54275 (low), GHSA-537c-gmf6-5ccf (high), CVE-2026-48504 (medium), CVE-2026-4372 (high), CVE-2026-44512 (medium), CVE-2026-5241 (high), CVE-2025-3000 (low), CVE-2026-59890 (medium), CVE-2026-63632 (low)

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2024-11392, CVE-2024-11394, CVE-2024-11393, CVE-2024-12720, CVE-2025-1194, CVE-2025-2099, CVE-2025-2953, CVE-2024-47081, CVE-2025-4565, CVE-2025-3730, CVE-2025-50181, CVE-2025-50182, CVE-2025-3263, CVE-2025-3264, CVE-2025-3777, CVE-2025-3933, CVE-2025-53643, CVE-2025-5197, CVE-2025-58160, CVE-2025-32434, CVE-2025-6638, CVE-2025-6051, CVE-2025-6921, CVE-2025-66418, CVE-2025-66471, CVE-2026-34073, CVE-2026-4539, CVE-2026-27489, CVE-2026-22815, CVE-2026-34445, CVE-2026-34446, CVE-2026-34447, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-49114, CVE-2026-1839, CVE-2025-71176, GHSA-965h-392x-2mh5, GHSA-xgp8-3hg3-c2mh, GHSA-cq8v-f236-94qc, CVE-2026-41681, CVE-2026-41898, CVE-2026-41678, CVE-2026-41677, CVE-2026-41676, GHSA-82j2-j2ch-gfr8, CVE-2026-42327, CVE-2026-44662, CVE-2026-44431, CVE-2026-45409, CVE-2026-45784, CVE-2026-34993, CVE-2026-47265, CVE-2026-25087, CVE-2025-2148, CVE-2025-2998, CVE-2025-2149, CVE-2025-2999, CVE-2025-3001, CVE-2026-50269, CVE-2026-54278, CVE-2026-54279, CVE-2026-54277, CVE-2026-54273, CVE-2026-54280, CVE-2026-54276, CVE-2026-54274, CVE-2026-54275, GHSA-537c-gmf6-5ccf, CVE-2026-48504, CVE-2026-4372, CVE-2026-44512, CVE-2026-5241, CVE-2025-3000, CVE-2026-59890, CVE-2026-63632, CVE-2026-59881, CVE-2026-69243, CVE-2026-69244, CVE-2026-69247, CVE-2026-9856