Security tab: triage the open Dependabot alerts (long-running)
Los mantenedores suelen responder en 1 día
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 25/100
Línea de trabajo
Start by comparing the current default branch with the manifests listed in the issue; Dependabot scans main, and the recorded alert counts are only a snapshot. After the planned develop to main merge, take a fresh Security tab snapshot and triage remaining alerts by manifest, starting with runtime dependencies in pyproject.toml, dincli/requirements.txt, and cache_model_0. Record each package bump or dismissal and its reason; the issue is done when remaining alerts are triaged and the Dependabot configuration decision is recorded.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Long-running tracking issue for the open Dependabot alerts on the Security tab. Abraham raised this ahead of inviting contract reviewers. No triage has been done yet; this issue records the starting point so the work can be picked up in pieces.
Where the alerts come from (snapshot, 29 Oct 2026)
646 open alerts — 32 critical, 256 high, 258 medium, 100 low. 542 pip, 104 npm.
Dependabot scans only the default branch (main), so these reflect main, not develop:
Manifest (on main) |
Alerts | On develop? |
|---|---|---|
fastapi/requirements.txt |
134 | No. Deleted on main too (538bcd5), so these alerts look stale |
dincli/requirements.txt |
134 | Rewritten on develop: 5 direct pins (typer, web3, platformdirs, py-cid, python-dotenv), no aiohttp/pillow/torch |
cache_model_0/requirements-cuda.txt |
133 | No. Replaced by cache_model_0/requirements.txt and per-role requirements/*/requirements.txt |
cache_model_0/requirements-cpu.txt |
133 | No. Same as above |
hardhat/package-lock.json |
104 | Yes, changed (secondary toolchain, dev-only) |
pyproject.toml |
8 | Yes |
The four pip manifests on main carry near-identical full-environment pins, so most of the count is the same few packages repeated four times: aiohttp (137), Pillow/pillow (232), torch (40), starlette (24), urllib3 (23), cryptography (21). The 32 critical alerts are Pillow and anyio (in each of the four pip files) plus handlebars, pbkdf2, form-data and sha.js in hardhat/package-lock.json.
Expect a large drop once develop reaches main (the planned develop → main merge), since most of the alerting manifests no longer exist on develop. The remaining alerts then need real triage.
Plan
- Dismiss the
fastapi/requirements.txtalerts as "no longer used" (the manifest was deleted). - After
developis merged intomain, take a fresh snapshot of what's still open. - Triage what remains, by manifest: runtime (
pyproject.toml,dincli/requirements.txt,cache_model_0requirements) first, then dev-only (hardhat/,foundry/npm lockfiles). - For each package: bump if it's used, dismiss with a reason if it's not reachable (e.g. dev-only tooling, code path unused).
- Decide whether to add a
.github/dependabot.yml(none today) so update PRs are grouped and scoped to the manifests we actually ship.
Comment here with each batch handled (manifest, packages, bumped or dismissed and why) so progress is visible without re-reading the Security tab.
Relates to #166 (testnet readiness).
- Lenguaje dominante
- Python
- Estrellas
- 4
- Forks
- 7
- Merge medio
- 3 d 4 h
- PR fusionados (30 d)
- 34
Preparar el entorno
Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de InfiniteZeroFoundation/DevNet
-
ROADMAP.md: refresh "What is still open for P3" (several items were fixed in October)Posiblemente ocupada @umermjd11 la tomó hace 2 días. Abiertodocumentation good first issue
Dificultad 2/5 1-3 horas Aptitud para principiantes 74/100
InfiniteZeroFoundation/DevNet#285 · 1 comentario · 1 asignado ·
Los mantenedores suelen responder en 1 día
-
Update the 25 translated organisation READMEs to match the English versionPosiblemente ocupada @mrCabez la tomó hoy. Abiertogood first issue help wanted
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
InfiniteZeroFoundation/DevNet#277 · 2 comentarios · 1 asignado ·
Los mantenedores suelen responder en 1 día
-
Update the client-service guide to explain training and uploading separatelyPosiblemente ocupada Un pull request vinculado a esta issue está abierto o ya se fusionó. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
InfiniteZeroFoundation/DevNet#266 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 5/5 Más de una semana Aptitud para principiantes 25/100
InfiniteZeroFoundation/DevNet#299 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
docs: fix broken install path, wrong commands and stale status in participant guidesPosiblemente ocupada @robertocarlous la tomó hace 2 días. Abierto
InfiniteZeroFoundation/DevNet#290 · 2 comentarios · 5 asignados ·
Los mantenedores suelen responder en 1 día
Todos los issues de InfiniteZeroFoundation/DevNet
Issues similares
-
priority middle
Dificultad 1/5 Menos de una hora Aptitud para principiantes 62/100
KATO-Hiro/AtCoderClans#12940 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 1/5 Menos de una hora Aptitud para principiantes 76/100
huggingface/huggingface_hub#5283 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 1/5 Menos de una hora Aptitud para principiantes 78/100
Los mantenedores suelen responder en 1 día
-
enhancement
Dificultad 1/5 Menos de una hora Aptitud para principiantes 86/100
ccxt/ccxt#31045 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
bug example
Dificultad 2/5 1-3 horas Aptitud para principiantes 86/100
Los mantenedores suelen responder en 1 día