zhaolei
6f402ffcee
- 后端: coworker 智能体框架, WS API, 文件上传, 附件处理 - 前端: Open WebUI, 文件全量走 upload API (含 MD/TXT/JSON 等文本类) - 技能: md-to-office (pandoc + wkhtmltopdf) - 修复: 上传文件路径丢失, Agent 搜索浪费, 输出文件跑到 uploads/ - 打包: PyInstaller one-dir, 预打包 pandoc/wkhtmltopdf/chromium
1.5 KiB
1.5 KiB
name, description
| name | description |
|---|---|
| dependency-audit | Scan lockfiles for vulnerable dependencies and triage by real reachability |
Audit the project's dependencies and separate what's exploitable from what's noise.
- Identify the ecosystems present (package-lock.json / pnpm-lock.yaml / yarn.lock, requirements*.txt / uv.lock / poetry.lock, go.sum, Cargo.lock, pyproject).
- Pick scanners that are present (check first; ask before installing):
osv-scanner --lockfile <each lockfile> --format json(best cross-ecosystem)npm audit --json/pip-audit -f json/trivy fs --scanners vuln . -f json
- Deduplicate advisories across scanners (key on advisory id + package), then triage
each one by reading the code:
- Direct or transitive? (
npm ls <pkg>,pipdeptree -r -p <pkg>or grep imports) - Is the vulnerable functionality actually used here? Grep for the affected API; an unreachable advisory in a dev-only tool is LOW no matter its CVSS.
- Verdict per advisory: fix-now / fix-soon / accept-with-note, one line of why.
- Direct or transitive? (
- Map each fix-now to its smallest closing upgrade (advisory metadata's fixed-in version); note when only a major closes it and what the migration entails.
- Deliver: an audit table (advisory · package · direct? · reachable? · verdict ·
smallest fix) ordered by real priority — then hand off to
safe-upgrade-prfor the actual upgrades. Offer a CI guard (e.g. an osv-scanner step) so new advisories surface on PRs instead of in the next audit.