[codex] 修复 Dependabot 安全告警 - #18
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
该 PR 主要用于消除 Dependabot 安全告警：通过前端 pnpm overrides/锁文件重新解析到修复版本、升级 voice runtime 的 Python 依赖，并在提交钩子中新增对 PR 模板/PR 描述“规范链接:”字段的校验，以减少不合规 PR 的产生。
Changes:
- 前端工作区新增
pnpm.overrides并更新frontend/pnpm-lock.yaml，将告警涉及的传递依赖提升到安全版本（含postcss修复版本）。 - 升级
config/voice-runtime/requirements.txt中的python-multipart版本以修复安全告警。 - 扩展
.githooks/pre-commit：提交前校验 PR 模板存在 “规范链接:” 字段，并在可用时校验当前分支 open PR 描述包含非空“规范链接:”。
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| setup-git-hooks.ps1 | 更新提示信息，说明 hooks 将额外执行 PR 规范链接校验。 |
| frontend/package.json | 增加 pnpm overrides 以修复前端依赖安全告警；新增 dev 脚本入口。 |
| frontend/pnpm-lock.yaml | 重新生成锁文件以确保解析到 overrides 指定的安全版本。 |
| config/voice-runtime/requirements.txt | 升级 python-multipart 以修复安全告警。 |
| AGENTS.md | 更新开发指引，说明 hooks 会拦截缺少“规范链接:”的 PR。 |
| .githooks/pre-commit | 增加 PR 模板/当前分支 PR 规范链接校验，并保留 Flyway 重复版本检查。 |
| "packageManager": "pnpm@10.29.3", | ||
| "scripts": { | ||
| "dev:admin": "pnpm --filter @mortise/admin dev", | ||
| "dev:mobile": "pnpm --filter @mortise/mobile dev", |
Comment on lines
+54
to
+61
| pr_url=$(gh pr list --head "$branch_name" --state open --json url --jq ".[0].url // \"\"" 2>/dev/null || true) | ||
| if [ -z "$pr_url" ]; then | ||
| echo "当前分支尚未关联 PR，跳过 PR 描述规范链接校验。" | ||
| return 0 | ||
| fi | ||
|
|
||
| pr_body=$(gh pr list --head "$branch_name" --state open --json body --jq ".[0].body // \"\"" 2>/dev/null || true) | ||
| if ! printf "%s" "$pr_body" | grep -Eq "规范链接:[[:space:]]*[^[:space:]]"; then |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变更内容
pnpm.overrides，将 Dependabot 告警中的传递依赖提升到已修复版本。frontend/pnpm-lock.yaml，确保锁文件解析到安全版本。python-multipart从0.0.20升级到0.0.26。pnpm audit发现的postcss < 8.5.10中危告警。规范链接:校验写入.githooks/pre-commit，提交前会检查 PR 模板以及当前分支 open PR 的规范链接字段。dev:mobile脚本，清理由未跟踪 mobile/education workspace 污染的 lockfile 条目，并将 hook 中两次gh pr list合并为一次查询。验证
pnpm audit --registry=https://registry.npmjs.org --audit-level moderatepnpm lintpnpm typecheckgit diff --check -- .githooks/pre-commit frontend/package.json frontend/pnpm-lock.yaml已知情况
.githooks/pre-commit仍会被工作区已有.codex-worktrees/old-codes迁移副本触发的 Flyway 重复版本检查拦截；本次新增的 PR 规范链接校验本身已验证通过。