[codex] 修复 Dependabot 安全告警

.githooks/pre-commit

@@ -4,13 +4,68 @@ set -eu
 
 ROOT_DIR=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
 
-if command -v pwsh >/dev/null 2>&1; then
-  exec pwsh -NoProfile -ExecutionPolicy Bypass -File "$ROOT_DIR/get-next-flyway-version.ps1" -FailOnDuplicates
-fi
+run_flyway_check() {
+  if command -v pwsh >/dev/null 2>&1; then
+    pwsh -NoProfile -ExecutionPolicy Bypass -File "$ROOT_DIR/get-next-flyway-version.ps1" -FailOnDuplicates
+    return $?
+  fi
 
-if command -v powershell >/dev/null 2>&1; then
-  exec powershell -NoProfile -ExecutionPolicy Bypass -File "$ROOT_DIR/get-next-flyway-version.ps1" -FailOnDuplicates
-fi
+  if command -v powershell >/dev/null 2>&1; then
+    powershell -NoProfile -ExecutionPolicy Bypass -File "$ROOT_DIR/get-next-flyway-version.ps1" -FailOnDuplicates
+    return $?
+  fi
 
-echo "未找到 pwsh 或 powershell，无法执行 Flyway pre-commit 校验。" >&2
-exit 1
+  echo "未找到 pwsh 或 powershell，无法执行 Flyway pre-commit 校验。" >&2
+  return 1
+}
+
+check_pr_template_spec_link() {
+  template_path="$ROOT_DIR/.github/pull_request_template.md"
+
+  if [ ! -f "$template_path" ]; then
+    echo "未找到 PR 模板：$template_path" >&2
+    return 1
+  fi
+
+  if ! grep -Eq "规范链接:" "$template_path"; then
+    echo "PR 模板缺少 \"规范链接:\" 字段，Spec Guard 会拒绝相关 PR。" >&2
+    return 1
+  fi
+}
+
+check_current_pr_spec_link() {
+  if ! command -v gh >/dev/null 2>&1; then
+    echo "未找到 gh，跳过当前分支 PR 规范链接校验。"
+    return 0
+  fi
+
+  if ! gh auth status >/dev/null 2>&1; then
+    echo "gh 未登录，跳过当前分支 PR 规范链接校验。"
+    return 0
+  fi
+
+  branch_name=$(git -C "$ROOT_DIR" branch --show-current 2>/dev/null || true)
+  case "$branch_name" in
+    "" | master | main)
+      return 0
+      ;;
+  esac
+
+  pr_info=$(gh pr list --head "$branch_name" --state open --json url,body --template '{{with index . 0}}{{.url}}{{"\n"}}{{.body}}{{end}}' 2>/dev/null || true)
+  pr_url=$(printf "%s\n" "$pr_info" | sed -n '1p')
+  if [ -z "$pr_url" ]; then
+    echo "当前分支尚未关联 PR，跳过 PR 描述规范链接校验。"
+    return 0
+  fi
+
+  pr_body=$(printf "%s\n" "$pr_info" | sed '1d')
+  if ! printf "%s" "$pr_body" | grep -Eq "规范链接:[[:space:]]*[^[:space:]]"; then
+    echo "当前分支 PR 缺少非空 \"规范链接:\" 字段：$pr_url" >&2
+    echo "请在 PR 描述中填写，例如：- 规范链接: https://github.com/rymcu/mortise/security/dependabot" >&2
+    return 1
+  fi
+}
+
+check_pr_template_spec_link
+check_current_pr_spec_link
+run_flyway_check

AGENTS.md

@@ -86,7 +86,7 @@ Always method-level `@PreAuthorize("hasAuthority('...')")`, never class-level.
 - Run `./get-next-flyway-version.ps1` before adding a migration, or scan all `src/main/resources/db/migration/V*.sql` across the entire repo.
 - Standard path: `mortise-xx-infra/src/main/resources/db/migration/`. Legacy: `mortise-xx/src/main/resources/db/migration/`. Both count.
 - Naming: `V{version}__{description}.sql`. Resolve duplicates before creating new scripts.
-- Run `./setup-git-hooks.ps1` once per clone to enable the pre-commit hook that blocks duplicate versions.
+- Run `./setup-git-hooks.ps1` once per clone to enable the pre-commit hook that blocks duplicate Flyway versions and PRs missing `规范链接:`.
 - DB: PostgreSQL 17 preferred.
 
 ## SPI Extension Pattern

config/voice-runtime/requirements.txt

@@ -1,6 +1,6 @@
 fastapi==0.116.1
 uvicorn[standard]==0.35.0
-python-multipart==0.0.20
+python-multipart==0.0.26
 soundfile==0.13.1
 sherpa-onnx-core==1.12.35
 sherpa-onnx==1.12.35

frontend/package.json

@@ -29,6 +29,27 @@
     "prettier-plugin-tailwindcss": "^0.7.2"
   },
   "pnpm": {
+    "overrides": {
+      "brace-expansion@2.0.2": "2.0.3",
+      "brace-expansion@5.0.4": "5.0.5",
+      "defu@6.1.4": "6.1.7",
+      "dompurify": "3.4.0",
+      "glob@10.4.5": "10.5.0",
+      "h3@1.15.8": "1.15.9",
+      "lodash": "4.18.0",
+      "lodash-es": "4.18.0",
+      "node-forge": "1.4.0",
+      "picomatch@2.3.1": "2.3.2",
+      "picomatch@4.0.3": "4.0.4",
+      "postcss": "8.5.10",
+      "protocol-buffers-schema": "3.6.1",
+      "serialize-javascript": "7.0.5",
+      "srvx@0.11.12": "0.11.15",
+      "unhead": "2.1.13",
+      "vite": "7.3.2",
+      "yaml@1.10.2": "1.10.3",
+      "yaml@2.8.2": "2.8.3"
+    },
     "peerDependencyRules": {
       "allowedVersions": {
         "citty": ">=0.1.6",