Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Security tab: triage the open Dependabot alerts (long-running)

Ouverte
  • Quelque chose ne va pas ?
#298 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
25/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
github, python
Domaine
devops, security

Piste de recherche

Start by comparing the current default branch with the manifests listed in the issue; Dependabot scans main, and the recorded alert counts are only a snapshot. After the planned develop to main merge, take a fresh Security tab snapshot and triage remaining alerts by manifest, starting with runtime dependencies in pyproject.toml, dincli/requirements.txt, and cache_model_0. Record each package bump or dismissal and its reason; the issue is done when remaining alerts are triaged and the Dependabot configuration decision is recorded.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Long run

Long-running tracking issue for the open Dependabot alerts on the Security tab. Abraham raised this ahead of inviting contract reviewers. No triage has been done yet; this issue records the starting point so the work can be picked up in pieces.

Where the alerts come from (snapshot, 29 Oct 2026)

646 open alerts — 32 critical, 256 high, 258 medium, 100 low. 542 pip, 104 npm.

Dependabot scans only the default branch (main), so these reflect main, not develop:

Manifest (on main) Alerts On develop?
fastapi/requirements.txt 134 No. Deleted on main too (538bcd5), so these alerts look stale
dincli/requirements.txt 134 Rewritten on develop: 5 direct pins (typer, web3, platformdirs, py-cid, python-dotenv), no aiohttp/pillow/torch
cache_model_0/requirements-cuda.txt 133 No. Replaced by cache_model_0/requirements.txt and per-role requirements/*/requirements.txt
cache_model_0/requirements-cpu.txt 133 No. Same as above
hardhat/package-lock.json 104 Yes, changed (secondary toolchain, dev-only)
pyproject.toml 8 Yes

The four pip manifests on main carry near-identical full-environment pins, so most of the count is the same few packages repeated four times: aiohttp (137), Pillow/pillow (232), torch (40), starlette (24), urllib3 (23), cryptography (21). The 32 critical alerts are Pillow and anyio (in each of the four pip files) plus handlebars, pbkdf2, form-data and sha.js in hardhat/package-lock.json.

Expect a large drop once develop reaches main (the planned develop → main merge), since most of the alerting manifests no longer exist on develop. The remaining alerts then need real triage.

Plan

  • Dismiss the fastapi/requirements.txt alerts as "no longer used" (the manifest was deleted).
  • After develop is merged into main, take a fresh snapshot of what's still open.
  • Triage what remains, by manifest: runtime (pyproject.toml, dincli/requirements.txt, cache_model_0 requirements) first, then dev-only (hardhat/, foundry/ npm lockfiles).
  • For each package: bump if it's used, dismiss with a reason if it's not reachable (e.g. dev-only tooling, code path unused).
  • Decide whether to add a .github/dependabot.yml (none today) so update PRs are grouped and scoped to the manifests we actually ship.

Comment here with each batch handled (manifest, packages, bumped or dismissed and why) so progress is visible without re-reading the Security tab.

Relates to #166 (testnet readiness).

Langage dominant
Python
Étoiles
4
Forks
7
Merge moyen
3 j 4 h
PR mergées (30 j)
34

Préparer son environnement

Ce projet ne fournit ni conteneur de développement, ni Dockerfile, ni guide de contribution : l'installation est à votre charge. Commencez par son README, et consultez notre guide de la première contribution pour les étapes générales.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de InfiniteZeroFoundation/DevNet

Toutes les issues de InfiniteZeroFoundation/DevNet

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.