🔒 Security Alerts — IBM/vpc-python-sdk

## 🔒 Security Alerts — IBM/vpc-python-sdk

> **Action required:** Remediate the alerts listed below before their SLA deadline.
> This issue will be closed automatically once all alerts are resolved.
>
> **SLA policy:** critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
> Alerts at or above medium severity will trigger a warning comment before the deadline and
> repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
> they will never trigger warnings or archiving.
>
> 💡 **Tip:** To have Dependabot automatically open fix PRs for dependency alerts, enable
> **Dependabot security updates** in your repo settings:
> Settings → Advanced Security → Dependabot security updates → Enable.
>
> 📖 **New to this issue?** See the [Security Issue Guide](https://ibm.github.io/security-ops-bot/security-issue-guide.html#what-you-should-do) for a full explanation of what this issue means and what you need to do.

Attention: @edabe @astha-jain @ibm-vpc @sumitkumartiwari @deepakibms

### Dependabot Alerts

| Severity | CVE/GHSA | Package | Affected | Patched | Fix PR |
|---|---|---|---|---|---|
| 🟠 high | CVE-2026-73566 | tar | <= 7.5.20 | 7.5.21 | — |
| 🟠 high | CVE-2026-14257 | brace-expansion | >= 4.0.0, < 5.0.8 | 5.0.8 | — |
| 🟠 high | CVE-2026-13697 | undici | >= 7.0.0, < 7.29.0 | 7.29.0 | [PR](https://github.com/IBM/vpc-python-sdk/pull/115) |
| 🟠 high | CVE-2026-69152 | brace-expansion | >= 4.0.0, < 5.0.9 | 5.0.9 | — |
| 🟠 high | CVE-2026-69192 | ip-address | <= 10.3.0 | 10.3.1 | — |
| 🟠 high | GHSA-5p4m-2wfm-xmqj | js-yaml | >= 4.0.0, < 4.3.1 | 4.3.1 | [PR](https://github.com/IBM/vpc-python-sdk/pull/119) |
| 🟠 high | CVE-2026-84375 | js-yaml | >= 4.0.0, < 4.3.2 | 4.3.2 | [PR](https://github.com/IBM/vpc-python-sdk/pull/119) |
| 🟡 medium | CVE-2026-54272 | ip-address | >= 10.1.1, <= 10.2.0 | 10.2.1 | — |
| 🟡 medium | CVE-2026-69198 | ip-address | >= 10.1.1, <= 10.2.1 | 10.2.2 | — |
| 🟡 medium | CVE-2026-16728 | undici | >= 7.0.0, < 7.29.0 | 7.29.0 | [PR](https://github.com/IBM/vpc-python-sdk/pull/115) |
| 🟡 medium | CVE-2026-14643 | undici | >= 7.0.0, < 7.29.0 | 7.29.0 | [PR](https://github.com/IBM/vpc-python-sdk/pull/115) |
| 🟡 medium | CVE-2026-16729 | undici | >= 7.0.0, < 7.29.0 | 7.29.0 | [PR](https://github.com/IBM/vpc-python-sdk/pull/115) |
| 🟡 medium | CVE-2026-15157 | undici | >= 7.0.0, < 7.29.0 | 7.29.0 | [PR](https://github.com/IBM/vpc-python-sdk/pull/115) |

### Code Scanning Alerts

_No open code scanning alerts._


### Secret Scanning Alerts

_No open secret scanning alerts._

---

Navigation Menu

Uh oh!

🔒 Security Alerts — IBM/vpc-python-sdk #118