🔒 Security Alerts — IBM/node-sdk-core

## 🔒 Security Alerts — IBM/node-sdk-core

> **Action required:** Remediate the alerts listed below before their SLA deadline.
> This issue will be closed automatically once all alerts are resolved.
>
> **SLA policy:** critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
> Alerts at or above medium severity will trigger a warning comment before the deadline and
> repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
> they will never trigger warnings or archiving.
>
> 💡 **Tip:** To have Dependabot automatically open fix PRs for dependency alerts, enable
> **Dependabot security updates** in your repo settings:
> Settings → Advanced Security → Dependabot security updates → Enable.

Attention: _(no direct admin collaborators assigned to this repo — please add an admin to receive security notifications)_

### Dependabot Alerts

| Severity | CVE/GHSA | Package | Affected | Patched | Fix PR |
|---|---|---|---|---|---|
| 🟡 medium | CVE-2026-33672 | picomatch | < 2.3.2 | 2.3.2 | — |
| 🟠 high | CVE-2026-33671 | picomatch | < 2.3.2 | 2.3.2 | — |
| 🟡 medium | CVE-2026-53550 | js-yaml | >= 4.0.0, <= 4.1.1 | 4.2.0 | — |
| 🟠 high | CVE-2026-59869 | js-yaml | >= 3.0.0, < 3.15.0 | 3.15.0 | — |
| 🟠 high | GHSA-5p4m-2wfm-xmqj | js-yaml | >= 4.0.0, < 4.3.1 | 4.3.1 | — |

---

Navigation Menu

Uh oh!

🔒 Security Alerts — IBM/node-sdk-core #368