Security tab: triage the open Dependabot alerts (long-running)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start by comparing the current default branch with the manifests listed in the issue; Dependabot scans main, and the recorded alert counts are only a snapshot. After the planned develop to main merge, take a fresh Security tab snapshot and triage remaining alerts by manifest, starting with runtime dependencies in pyproject.toml, dincli/requirements.txt, and cache_model_0. Record each package bump or dismissal and its reason; the issue is done when remaining alerts are triaged and the Dependabot configuration decision is recorded.
由索引模型根据 Issue 内容生成。
描述
Long-running tracking issue for the open Dependabot alerts on the Security tab. Abraham raised this ahead of inviting contract reviewers. No triage has been done yet; this issue records the starting point so the work can be picked up in pieces.
Where the alerts come from (snapshot, 29 Oct 2026)
646 open alerts — 32 critical, 256 high, 258 medium, 100 low. 542 pip, 104 npm.
Dependabot scans only the default branch (main), so these reflect main, not develop:
Manifest (on main) |
Alerts | On develop? |
|---|---|---|
fastapi/requirements.txt |
134 | No. Deleted on main too (538bcd5), so these alerts look stale |
dincli/requirements.txt |
134 | Rewritten on develop: 5 direct pins (typer, web3, platformdirs, py-cid, python-dotenv), no aiohttp/pillow/torch |
cache_model_0/requirements-cuda.txt |
133 | No. Replaced by cache_model_0/requirements.txt and per-role requirements/*/requirements.txt |
cache_model_0/requirements-cpu.txt |
133 | No. Same as above |
hardhat/package-lock.json |
104 | Yes, changed (secondary toolchain, dev-only) |
pyproject.toml |
8 | Yes |
The four pip manifests on main carry near-identical full-environment pins, so most of the count is the same few packages repeated four times: aiohttp (137), Pillow/pillow (232), torch (40), starlette (24), urllib3 (23), cryptography (21). The 32 critical alerts are Pillow and anyio (in each of the four pip files) plus handlebars, pbkdf2, form-data and sha.js in hardhat/package-lock.json.
Expect a large drop once develop reaches main (the planned develop → main merge), since most of the alerting manifests no longer exist on develop. The remaining alerts then need real triage.
Plan
- Dismiss the
fastapi/requirements.txtalerts as "no longer used" (the manifest was deleted). - After
developis merged intomain, take a fresh snapshot of what's still open. - Triage what remains, by manifest: runtime (
pyproject.toml,dincli/requirements.txt,cache_model_0requirements) first, then dev-only (hardhat/,foundry/npm lockfiles). - For each package: bump if it's used, dismiss with a reason if it's not reachable (e.g. dev-only tooling, code path unused).
- Decide whether to add a
.github/dependabot.yml(none today) so update PRs are grouped and scoped to the manifests we actually ship.
Comment here with each batch handled (manifest, packages, bumped or dismissed and why) so progress is visible without re-reading the Security tab.
Relates to #166 (testnet readiness).
- 主要语言
- Python
- 星标
- 4
- 派生
- 7
- 平均合并
- 3 天 5 小时
- 30 天内合并 PR
- 34
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
InfiniteZeroFoundation/DevNet 的其他 Issue
-
ROADMAP.md: refresh "What is still open for P3" (several items were fixed in October)可能已有人在做 @umermjd11 于 3 天前认领。 未关闭documentation good first issue
难度 2/5 1-3 小时 新手友好度 74/100
InfiniteZeroFoundation/DevNet#285 · 1 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
Update the 25 translated organisation READMEs to match the English version可能已有人在做 @mrCabez 于 1 天前认领。 未关闭good first issue help wanted
难度 2/5 1-3 小时 新手友好度 76/100
InfiniteZeroFoundation/DevNet#277 · 2 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
Update the client-service guide to explain training and uploading separately可能已有人在做 @Santiagocetran 于 1 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 76/100
InfiniteZeroFoundation/DevNet#266 · 已指派 1 人 ·
维护者通常 1 天内回复
-
Few questions related to GI2 aggregator可能已有人在做 @Abidoyesimze 今天认领。 未关闭
InfiniteZeroFoundation/DevNet#307 · 1 个 reaction · 已指派 4 人 ·
维护者通常 1 天内回复
-
bug python
难度 4/5 3-5 天 新手友好度 52/100
InfiniteZeroFoundation/DevNet#306 ·
维护者通常 1 天内回复
查看 InfiniteZeroFoundation/DevNet 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
vllm-project/vllm#64845 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 84/100
dekobon/big-code-analysis#1729 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
pydantic/pydantic-ai#12091 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100