On Azure-sdk-bom version 1.3.9: several CVE's on dependencies #50905

Activity

1. github-actions commented on Oct 21, 2026

   

   github-actionsBot

   on Oct 21, 2026 – with GitHub Actions

   Contributor

   More actions

   🎯 Agentic Issue Triage — Needs Manual Review

   🏷️ Label Decision

   • Candidate labels considered: Client + Core (azure-core, which pulls in reactor-core/netty), Client + Azure Core netty/http-netty transport. Neither is clearly named; "version 1.3.9" doesn't identify an artifact, and the CVEs are in third-party dependencies (reactor, netty).
   • Confidence blockers: No specific Azure SDK package or /sdk/ path is named; multiple service labels are plausible, so exactly one can't be chosen confidently.
   • Outcome: Requested needs-triage — could not confidently predict labels.

   👥 Owner Routing

   • CODEOWNERS scan: Not performed, because needs-triage was requested and the owner lookup steps were skipped.
   • Matched entry: none
   • Owners found: none
   • Outcome: Manual routing needed once the affected package is identified.

   Generated by Agentic Triage for #50905 · auto · 15 AIC · ⊞ 16.3K · ◷
2. github-actions

   added

   needs-triageWorkflow: This is a new issue that needs to be triaged to the appropriate team.Workflow: This is a new issue that needs to be triaged to the appropriate team.

   on Oct 21, 2026
3. avpragana

   changed the title [-]On version 1.3.9: several CVE's on dependencies[/-] [+]On Azure-sdk-bom version 1.3.9: several CVE's on dependencies[/+] on Oct 22, 2026
4. Jair Myree (jairmyree)

   self-assigned this

   on Oct 23, 2026
5. Jair Myree (jairmyree)

   added

   azure-sdk-bomAzure Java SDK BOM (Bill of Materials)Azure Java SDK BOM (Bill of Materials)

   and removed

   needs-triageWorkflow: This is a new issue that needs to be triaged to the appropriate team.Workflow: This is a new issue that needs to be triaged to the appropriate team.

   on Oct 27, 2026
6. jairmyree commented on Oct 27, 2026

   

   Jair Myree (jairmyree)

   on Oct 27, 2026

   Member

   More actions

   Hello avpragana, these dependencies will be updated in the upcoming release of the BOM.