🔒 Security Alerts — IBM/nodejs-itoolkit

## 🔒 Security Alerts — IBM/nodejs-itoolkit

> **Action required:** Remediate the alerts listed below before their SLA deadline.
> This issue will be closed automatically once all alerts are resolved.
>
> **SLA policy:** critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
> Alerts at or above medium severity will trigger a warning comment before the deadline and
> repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
> they will never trigger warnings or archiving.
>
> 💡 **Tip:** To have Dependabot automatically open fix PRs for dependency alerts, enable
> **Dependabot security updates** in your repo settings:
> Settings → Advanced Security → Dependabot security updates → Enable.

Attention: @kadler @ThePrez @abmusse

### Dependabot Alerts

| Severity | CVE/GHSA | Package | Affected | Patched | Fix PR |
|---|---|---|---|---|---|
| 🟠 high | CVE-2026-69192 | ip-address | <= 10.3.0 | 10.3.1 | — |
| 🟠 high | GHSA-5p4m-2wfm-xmqj | js-yaml | >= 4.0.0, < 4.3.1 | 4.3.1 | — |
| 🟠 high | CVE-2026-73086 | nanoid | < 3.3.12 | 3.3.12 | — |
| 🟠 high | CVE-2026-84375 | js-yaml | >= 4.0.0, < 4.3.2 | 4.3.2 | — |

---

Navigation Menu

Uh oh!

🔒 Security Alerts — IBM/nodejs-itoolkit #415