zhaolei
6f402ffcee
- 后端: coworker 智能体框架, WS API, 文件上传, 附件处理 - 前端: Open WebUI, 文件全量走 upload API (含 MD/TXT/JSON 等文本类) - 技能: md-to-office (pandoc + wkhtmltopdf) - 修复: 上传文件路径丢失, Agent 搜索浪费, 输出文件跑到 uploads/ - 打包: PyInstaller one-dir, 预打包 pandoc/wkhtmltopdf/chromium
1.3 KiB
1.3 KiB
name, description
| name | description |
|---|---|
| safe-upgrade-pr | Ship minimal, test-verified dependency upgrades as focused PRs |
Turn triaged advisories into upgrade PRs a reviewer can merge without fear.
- One branch per ecosystem (
security/deps-npm,security/deps-python), smallest viable bumps: the fixed-in patch/minor, not "latest". Majors get their own branch and a migration note. - Regenerate lockfiles with the repo's OWN toolchain (
npm install pkg@ver,uv lock,poetry update pkg…) — never hand-edit a lockfile. - Verify before proposing: clean install, build, and the project's test suite. Red suite → investigate; if the bump itself breaks the build, document what's entangled and propose the next-smallest path instead of forcing it.
- PR body per upgrade: advisory id(s) closed, package old→new version, reachability verdict from the audit (one line), and the verification commands run. Skip CVE boilerplate walls — link the advisory instead.
- Leave
accept-with-noteadvisories OUT of the PR; record them in the PR body's "consciously not fixed" list with their justification, so the decision is visible and revisitable. - Never merge your own upgrade PR — deliver it with what a reviewer should check (typically: lockfile diff sanity and the test run).