Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Security tab: triage the open Dependabot alerts (long-running)

Aperta
  • Qualcosa non va?
#298 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
github, python
Ambito
devops, security

Direzione di ricerca

Start by comparing the current default branch with the manifests listed in the issue; Dependabot scans main, and the recorded alert counts are only a snapshot. After the planned develop to main merge, take a fresh Security tab snapshot and triage remaining alerts by manifest, starting with runtime dependencies in pyproject.toml, dincli/requirements.txt, and cache_model_0. Record each package bump or dismissal and its reason; the issue is done when remaining alerts are triaged and the Dependabot configuration decision is recorded.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Long run

Long-running tracking issue for the open Dependabot alerts on the Security tab. Abraham raised this ahead of inviting contract reviewers. No triage has been done yet; this issue records the starting point so the work can be picked up in pieces.

Where the alerts come from (snapshot, 29 Oct 2026)

646 open alerts — 32 critical, 256 high, 258 medium, 100 low. 542 pip, 104 npm.

Dependabot scans only the default branch (main), so these reflect main, not develop:

Manifest (on main) Alerts On develop?
fastapi/requirements.txt 134 No. Deleted on main too (538bcd5), so these alerts look stale
dincli/requirements.txt 134 Rewritten on develop: 5 direct pins (typer, web3, platformdirs, py-cid, python-dotenv), no aiohttp/pillow/torch
cache_model_0/requirements-cuda.txt 133 No. Replaced by cache_model_0/requirements.txt and per-role requirements/*/requirements.txt
cache_model_0/requirements-cpu.txt 133 No. Same as above
hardhat/package-lock.json 104 Yes, changed (secondary toolchain, dev-only)
pyproject.toml 8 Yes

The four pip manifests on main carry near-identical full-environment pins, so most of the count is the same few packages repeated four times: aiohttp (137), Pillow/pillow (232), torch (40), starlette (24), urllib3 (23), cryptography (21). The 32 critical alerts are Pillow and anyio (in each of the four pip files) plus handlebars, pbkdf2, form-data and sha.js in hardhat/package-lock.json.

Expect a large drop once develop reaches main (the planned develop → main merge), since most of the alerting manifests no longer exist on develop. The remaining alerts then need real triage.

Plan

  • Dismiss the fastapi/requirements.txt alerts as "no longer used" (the manifest was deleted).
  • After develop is merged into main, take a fresh snapshot of what's still open.
  • Triage what remains, by manifest: runtime (pyproject.toml, dincli/requirements.txt, cache_model_0 requirements) first, then dev-only (hardhat/, foundry/ npm lockfiles).
  • For each package: bump if it's used, dismiss with a reason if it's not reachable (e.g. dev-only tooling, code path unused).
  • Decide whether to add a .github/dependabot.yml (none today) so update PRs are grouped and scoped to the manifests we actually ship.

Comment here with each batch handled (manifest, packages, bumped or dismissed and why) so progress is visible without re-reading the Security tab.

Relates to #166 (testnet readiness).

Lingua principale
Python
Stelle
4
Fork
7
Merge medio
3g 4h
PR unite (30g)
34

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di InfiniteZeroFoundation/DevNet

Tutte le issue di InfiniteZeroFoundation/DevNet

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.