🔒 Security Alerts — IBM/cpex-plugins

## 🔒 Security Alerts — IBM/cpex-plugins

> **Action required:** Remediate the alerts listed below before their SLA deadline.
> This issue will be closed automatically once all alerts are resolved.
>
> **SLA policy:** critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
> Alerts at or above medium severity will trigger a warning comment before the deadline and
> repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
> they will never trigger warnings or archiving.
>
> 💡 **Tip:** To have Dependabot automatically open fix PRs for dependency alerts, enable
> **Dependabot security updates** in your repo settings:
> Settings → Advanced Security → Dependabot security updates → Enable.
>
> 📖 **New to this issue?** See the [Security Issue Guide](https://ibm.github.io/security-ops-bot/security-issue-guide.html#what-you-should-do) for a full explanation of what this issue means and what you need to do.

Attention: @jonpspri @ja8zyjits @brian-hussey

### Dependabot Alerts

| Severity | CVE/GHSA | Package | Affected | Patched | Fix PR |
|---|---|---|---|---|---|
| 🟠 high | CVE-2026-48526 | pyjwt | < 2.13.0 | 2.13.0 | — |
| 🟠 high | GHSA-537c-gmf6-5ccf | cryptography | >= 0.5.0, < 48.0.1 | 48.0.1 | — |
| 🟠 high | CVE-2026-48818 | starlette | < 1.1.0 | 1.1.0 | — |
| 🟠 high | CVE-2026-53539 | python-multipart | < 0.0.30 | 0.0.30 | — |
| 🟠 high | CVE-2026-54283 | starlette | >= 0.4.1, < 1.3.1 | 1.3.1 | — |
| 🟠 high | CVE-2026-69249 | cryptography | >= 42.0.0, <= 48.0.0 | 49.0.0 | — |
| 🟡 medium | CVE-2026-48523 | pyjwt | >= 2.9.0, < 2.13.0 | 2.13.0 | — |
| 🟡 medium | CVE-2026-48525 | pyjwt | >= 2.8.0, <= 2.12.1 | 2.13.0 | — |
| 🟡 medium | CVE-2026-48817 | starlette | < 1.1.0 | 1.1.0 | — |
| 🔵 low | CVE-2026-53537 | python-multipart | < 0.0.30 | 0.0.30 | — |
| 🔵 low | CVE-2026-53538 | python-multipart | < 0.0.30 | 0.0.30 | — |
| 🔵 low | CVE-2026-53540 | python-multipart | < 0.0.31 | 0.0.31 | — |
| 🔵 low | CVE-2026-54282 | Starlette | < 1.3.0 | 1.3.0 | — |

### Code Scanning Alerts

_No open code scanning alerts._


### Secret Scanning Alerts

_No open secret scanning alerts._

---

Navigation Menu

Uh oh!

🔒 Security Alerts — IBM/cpex-plugins #179