Core tool version drift detected

未关闭

#93 创建于 2026年7月27日 15 条评论 1 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

未指定文件或测试。请在仓库中搜索表格列出的固定版本，然后检查运行 OpenGrep、TruffleHog、Trivy 和 Socket CLI 的 workflow 或入口点。完成的标准是已更新受支持的漂移，并且现有扫描检查通过，同时 OpenGrep 尚未解析的最新坐标仍仅用于报告。

由索引模型根据 Issue 内容生成。

core-tool-drift

Tool	Pinned	Latest	Drift	Socket (pinned)	Socket (latest)
OpenGrep (SAST engine)	`v1.26.0`	`v1.30.0`	⬆️ `v1.30.0`	✅ clean (599 alerts)	❓ coordinate not resolvable
TruffleHog (secret scanner)	`3.96.0`	`v3.97.5`	⬆️ `v3.97.5`	✅ clean (12 alerts)	✅ clean (20 alerts)
Trivy (Socket trivy-dist)	`0.73.0`	`0.73.0`	✅ current	✅ clean (21 alerts)	✅ clean (21 alerts)
Socket SDK (socket-sdk-python)	`3.6.0`	`3.6.0`	✅ current	✅ clean (5 alerts)	✅ clean (5 alerts)
Socket Python CLI (socket-python-cli)	`2.9.0`	`2.9.4`	⬆️ `2.9.4`	✅ clean (4 alerts)	✅ clean (6 alerts)
Socket npm CLI (socket-cli)	`1.1.165`	`1.1.176`	⬆️ `1.1.176`	✅ clean (2 alerts)	✅ clean (2 alerts)

OpenGrep (SAST engine): GitHub-release binary; not Dependabot-trackable and not covered by Socket's pkg:github coordinates. Falls back to the upstream Semgrep lineage (pkg:pypi/semgrep) as a project-health proxy -- this does NOT analyze OpenGrep's own release artifacts, so it is reported, never build-failing.
Trivy (Socket trivy-dist): Release drift follows the Socket-built ghcr.io/socketdev/trivy package (produced by SocketDev/trivy-dist and mirrored privately to Docker Hub), not Aqua's release feed. Socket scoring uses the corresponding upstream Go module because trivy-dist rebuilds that source without modification.

issue: imported chats all show as unread in the sidebar 未关闭

bug confirmed issue

难度 2/5 1-3 小时新手友好度 75/100

open-webui/open-webui#30750 · 1 条评论 · 2026年9月24日创建
OGS AmBe example has no source.timing block, so every event sits at time zero 未关闭

难度 2/5 1-3 小时新手友好度 75/100

lanl/ScintiPix#61 · 2026年9月24日创建
Make Liquid Glass the default theme for the Research build 未关闭

enhancement

难度 2/5 1-3 小时新手友好度 75/100

OpenwaterHealth/openmotion-bloodflow-app#604 · 1 条评论 · 2026年9月24日创建
tests/puppeteer/test_openai_api_key_ui.js targets controls that do not exist and is run by no workflow 未关闭

难度 2/5 1-3 小时新手友好度 70/100

LearningCircuit/local-deep-research#6766 · 2026年9月23日创建
Delete unused args argument from main() in Python files 未关闭

good first issue

难度 1/5 1 小时以内新手友好度 90/100

ros2/launch#1014 · 2026年9月23日创建