π [IBM OSPO Security Notification] β IBM/secrets-manager-node-sdk
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 65/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- node.js, typescript
- Domain
- security
Research direction
Start with the Dependabot Alerts table and inspect the repository's dependency configuration for ip-address and undici. Done means all listed alerts are resolved using the patched versions, with no open code-scanning or secret-scanning alerts remaining.
Written by the indexing model from the issue text.
Description
π [IBM OSPO Security Notification] β IBM/secrets-manager-node-sdk
Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only β
they will never trigger warnings or archiving.π‘ Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings β Advanced Security β Dependabot security updates β Enable.π New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.
Attention: @IdanAdar @rotembr @secrets-automation-dev
Dependabot Alerts
| Severity | CVE/GHSA | Package | Affected | Patched | Deadline | Fix PR |
|---|---|---|---|---|---|---|
| π high | CVE-2026-69192 | ip-address | <= 10.3.0 | 10.3.1 | 2026-10-19 | β |
| π‘ medium | CVE-2026-54272 | ip-address | >= 10.1.1, <= 10.2.0 | 10.2.1 | 2026-12-18 | β |
| π‘ medium | CVE-2026-69198 | ip-address | >= 10.1.1, <= 10.2.1 | 10.2.2 | 2026-12-18 | β |
| π‘ medium | CVE-2026-16728 | undici | < 6.28.0 | 6.28.0 | 2026-12-18 | β |
| π‘ medium | CVE-2026-16729 | undici | < 6.28.0 | 6.28.0 | 2026-12-18 | β |
| π‘ medium | CVE-2026-15157 | undici | < 6.28.0 | 6.28.0 | 2026-12-18 | β |
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.
- Dominant language
- TypeScript
- Stars
- 3
- Forks
- 7
- Avg merge
- 16h 30m
- Merged PRs (30d)
- 10
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up β it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from IBM/secrets-manager-node-sdk
-
Dependency Dashboard Open
Difficulty 4/5 3-5 days Newbie friendliness 15/100
IBM/secrets-manager-node-sdk#180 Β·
All issues in IBM/secrets-manager-node-sdk
Similar issues
-
comp/dashboard P3 type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
NousResearch/hermes-agent#117722 Β·
-
clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:ux-friction issue-rating: π¦ diamond lobster no-stale P3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 76/100
-
code-quality refactoring
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
github/gh-aw-firewall#8816 Β·
-
integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
langchain-ai/deepagents#6450 Β·