Skip to content

build(security): Dependabot 54 条批量处置——四线升级 + 2 条有据 dismiss（I-239） #1218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ThreeFish-AI merged 12 commits into from
Oct 28, 2026
Merged

build(security): Dependabot 54 条批量处置——四线升级 + 2 条有据 dismiss（I-239） #1218

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
70eb44c
build(negentropy): backend 安全地板抬升与 11 包收敛升级，清偿 Dependabot 34 条告警 (I-2…
ThreeFish-AI Oct 28, 2026
24542a3
build(deps): katex 0.16→0.18.11 越线升级 + 根 override 地板（katex/fast-uri），…
ThreeFish-AI Oct 28, 2026
0e381de
build(influence): 15 分集 fast-uri 安全地板 override，清偿 Dependabot 15 条告警 (…
ThreeFish-AI Oct 28, 2026
026158c
build(perceives): 七包升级防 CI 红头 + litellm 条件触发项 ignore（I-239）;
ThreeFish-AI Oct 28, 2026
e08d4aa
docs(agents): 登记 I-239——Dependabot 54 条批量处置经验（四线并进与 2 条有据 dismiss）;
ThreeFish-AI Oct 28, 2026
b7937f0
test(perceives): 修 test_error_logging_and_handling 与外网环境的耦合（I-239）;
ThreeFish-AI Oct 28, 2026
9dcbaa7
build(negentropy): litellm 收敛目标抬至 1.95.1，清偿 Dependency Review 硬门 (I-2…
ThreeFish-AI Oct 28, 2026
117fbed
docs(agents): I-239 增量——litellm g5ff 经 Dependency Review 硬门抬至 1.95.1 …
ThreeFish-AI Oct 28, 2026
50bf345
ci: 空提交重触发 PR synchronize 事件（GitHub Actions 事件管道未处理上一轮 push）
ThreeFish-AI Oct 28, 2026
7479c35
ci: 空提交重放 synchronize 事件（Dependency Review 待重跑）
ThreeFish-AI Oct 28, 2026
e52c80d
docs(agents): 合入 feature/1.x.x——DSA 精读 I-239 撞号处置，Dependabot 批量处置条目重编…
ThreeFish-AI Oct 28, 2026
349db07
build(negentropy): litellm 再收敛至 1.100.5，清偿 Dependency Review 第二次拦截 (I…
ThreeFish-AI Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/negentropy-perceives-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,12 @@ jobs:
# transformers 受 pillow 冲突钉死 4.57.6，二者在 docling engine worker 导入链上不兼容
#（实测 parse-pdf 由 Success 变 Failed: cannot import name AutoProcessor）——见 I-092
--ignore-vuln CVE-2025-3000

# litellm 1.96.2 CVE-2026-114612（GHSA-7hp6-4w63-5g45）：仅在显式开启
# EXPERIMENTAL_UI_LOGIN=true 时经 salt-key 复用提权 proxy_admin（RCE）——本项目
# 未启用 proxy UI 登录（默认 false），攻击向量不可达；修复在 1.100.4+，需跳新线，
# 与 apps/negentropy 侧 litellm 残留同口径，随 litellm 新线升级一并清偿（follow-up）
--ignore-vuln CVE-2026-114612
)
uv run pip-audit "${ignore_args[@]}"

Expand Down
9 changes: 5 additions & 4 deletions apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/negentropy-influence/episodes/agent-skills-video/video/pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,3 +48,6 @@ overrides:
# GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免
# major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。
source-map-js: '>=1.2.2 <2.0.0'
# GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本
# 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。
fast-uri: '>=3.1.8 <4.0.0'
9 changes: 5 additions & 4 deletions apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/negentropy-influence/episodes/claude-code-concurrency-video/video/pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@ overrides:
# GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免
# major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。
source-map-js: '>=1.2.2 <2.0.0'
# GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本
# 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。
fast-uri: '>=3.1.8 <4.0.0'
9 changes: 5 additions & 4 deletions apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/negentropy-influence/episodes/claude-code-explained-video/video/pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@ overrides:
# GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免
# major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。
source-map-js: '>=1.2.2 <2.0.0'
# GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本
# 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。
fast-uri: '>=3.1.8 <4.0.0'
9 changes: 5 additions & 4 deletions apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/negentropy-influence/episodes/claude-code-memory-video/video/pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@ overrides:
# GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免
# major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。
source-map-js: '>=1.2.2 <2.0.0'
# GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本
# 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。
fast-uri: '>=3.1.8 <4.0.0'
9 changes: 5 additions & 4 deletions apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/negentropy-influence/episodes/claude-code-multiagent-video/video/pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@ overrides:
# GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免
# major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。
source-map-js: '>=1.2.2 <2.0.0'
# GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本
# 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。
fast-uri: '>=3.1.8 <4.0.0'
9 changes: 5 additions & 4 deletions apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/negentropy-influence/episodes/claude-code-planning-video/video/pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@ overrides:
# GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免
# major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。
source-map-js: '>=1.2.2 <2.0.0'
# GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本
# 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。
fast-uri: '>=3.1.8 <4.0.0'
9 changes: 5 additions & 4 deletions apps/negentropy-influence/episodes/context-layer-video/video/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/negentropy-influence/episodes/context-layer-video/video/pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@ overrides:
# GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免
# major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。
source-map-js: '>=1.2.2 <2.0.0'
# GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本
# 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。
fast-uri: '>=3.1.8 <4.0.0'
9 changes: 5 additions & 4 deletions apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions apps/negentropy-influence/episodes/dream-rsi-video/video/pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@ overrides:
# GHSA-68fv-2mgg-jv7q (high)：source-map-js < 1.2.2 事件循环 DoS；floor 1.2.2、限 <2 避免
# major 跳跃，与仓库根 pnpm-workspace.yaml 同口径（I-237）。
source-map-js: '>=1.2.2 <2.0.0'
# GHSA-hrr3-gc8f-f4qj (medium)：fast-uri < 3.1.8 decodeURIComponent 回溯。ajv 传递（无版本
# 封顶），floor 3.1.8、限 <4 避免 major 跳跃，与仓库根 pnpm-workspace.yaml 同口径。
fast-uri: '>=3.1.8 <4.0.0'
Loading
Loading