build(deps-dev): bump the eslint group in /frontend with 7 updates#13
Open
dependabot[bot] wants to merge 11 commits into
Open
build(deps-dev): bump the eslint group in /frontend with 7 updates#13dependabot[bot] wants to merge 11 commits into
dependabot[bot] wants to merge 11 commits into
Conversation
Create HOS-Forge extension layer on top of OpenHands base: - hosforge/ package structure with security extension modules - Security Agent framework (Base, Supervisor, Audit, Defense agents) - Security rule engine with OWASP Top 10 coverage - Knowledge base interface for CVE/CWE RAG integration - Security Tool base class for external tool adapters - HOS-Forge branding and project configuration Architecture: - All extensions in hosforge/ — zero modifications to openhands/ core - Extension Layer pattern enables upstream sync compatibility - Agent system uses composition over inheritance with OpenHands Co-Authored-By: Claude <noreply@anthropic.com>
Major update: Reality Enforcement + Brand Visual Identity === HOS-Silly-Mock (Python Port) === - Ported 4-layer detection engine from TypeScript to Python - Layer 1: Mock Exposure — catch→fallback + unannotated static data detection - Layer 2: Regex Blocker — detection of regex for structured data parsing - Layer 3: Reality Binding — source→transform→sink variable trace tracking - Layer 4: Silent Failure — empty catch + missing error path + no-IO system detection - Reality Score calculator with weighted layer scoring (0-100) - Full EnforcementConfig with per-layer options - CLI-friendly analyze_lines() and enforce_text() interfaces === Safe Hyacinth Visual Theme === - New CSS design token system (hos-forge-theme.css) - Color palette: deep purple (#2D1A36), lavender (#8C6E9F), burgundy (#862C3B), neon green (#6CCB4C), dark charcoal (#1E1F1D) - Glass glaze effect with CSS gradients (hos-petal, hos-glaze) - UI components: hos-btn, hos-card, hos-input, hos-status-dot - Tailwind config: hyacinth/hos color families - PNG favicon replacing OpenHands branding - HOS-Forge branded SVGs preserving hand shape with new colors - Root meta title/description updated - i18n branding strings replaced Architecture: - All visual changes via CSS variable override — no React component rewrites - Silly-Mock in hosforge/reality_enforcement/ — zero OpenHands core changes - Reality Score gates in CI/CD pipeline ready Co-Authored-By: Claude <noreply@anthropic.com>
=== Attack Agent (Penetration Testing) === - Full PTES workflow: Recon → Scanning → Vuln Assessment → Exploit → Report - 5-phase pentest lifecycle with detailed phase tracking - Tool adapter system: auto-detects Nmap/Nuclei for scanning - Authorization gating: exploit phase only runs when authorized - HTML + Markdown report generation built-in - Executive summary, risk scoring, dedup, severity classification === MCP Security Tool Adapters === - NmapTool: port scanning, service detection, OS fingerprinting - SemgrepTool: SAST scanning, custom rules, SARIF output - NucleiTool: template-based vulnerability scanning, CVE detection - BurpTool: Burp Suite REST API integration (scan/proxy/replay/report) - All tools inherit from BaseSecurityTool with validate() + run() === CVE/CWE RAG Knowledge Base === - LocalKnowledgeBase: SQLite-backed CVE/CWE storage - NVD JSON import: batch CVE data ingestion - CWE JSON import: weakness taxonomy with mitigations - Keyword search across CVE descriptions and CWE entries - ExploitDB PoC retrieval interface - KEV (Known Exploited Vulnerabilities) check - Vulnerability explanation engine (CVE + CWE + code context) === Security HTML Reporter === - Fixed-format HTML reports (safe hyacinth design system) - Pentest/Audit/Scan/Compliance report types - Risk score visualization with animated bar - Vulnerability table with severity badges - Phase execution grid - Print/PDF optimized (auto light mode on print) - HTML escaping and responsive layout Co-Authored-By: Claude <noreply@anthropic.com>
=== 定位升级: 网络安全 → 信息安全全领域 === - Web安全 | 数据安全 | 终端安全 | 密码学 | 云安全 | 应用安全 | 移动安全 - CLAUDE.md/README.md 全量更新 === HOS-Model-Optimizer 集成 === - 本地模型微调 (QLoRA/LoRA, 8GB VRAM) - RAG打标引擎 (SecurityRAGTagger) — 自动提取安全标签+分类 - 批量CVE/CWE知识库打标 (chunking + embedding) - JSONL训练数据导出 (用于微调安全专用模型) - 兼容Alpaca/ShareGPT格式 === HOS MCP Server (关键基础设施) === - 基于FastMCP, 支持stdio/SSE双模式传输 - 12个MCP工具端点: hos_nmap_scan, hos_semgrep_scan, hos_nuclei_scan, hos_burp_scan, hos_cve_query, hos_cwe_query, hos_vuln_explain, hos_pentest_run, hos_security_audit, hos_fix_vulnerability, hos_report_generate, hos_reality_check - Claude Desktop/Code / Cursor 可直接调用 - 端口8321 (安全风信子) === Security Dashboard === - 态势感知仪表盘 (风险评分/漏洞统计/阶段展示) - 可嵌入HTML/React (iframe/webview) - 支持从PentestReport自动构建 - 安全风信子设计系统 Co-Authored-By: Claude <noreply@anthropic.com>
=== MCP Discovery Engine ===
- 自动检测: 进程/Docker/端口/环境变量/Claude配置
- 5种发现来源覆盖所有安装场景
- 已知安全MCP注册表 (Burp/SecurityHub/pentestMCP/Ghidra/CVE)
- 服务去重与状态管理
=== MCP Adapters ===
- StdioMCPAdapter: 子进程 stdio 通信 (Claude Desktop模式)
- SSEHttpMCPAdapter: HTTP SSE 通信 (服务模式)
- 统一 connect/call_tool/disconnect 生命周期
=== 具体连接器 ===
- BurpConnector: 桥接 PortSwigger 官方 MCP
* get_proxy_history / analyze_request / start_scan / repeater
- SecurityHubConnector: 桥接 FuzzingLabs mcp-security-hub
* 14个子工具: nmap/nuclei/sqlmap/ghidra/cve_search/subfinder/...
=== MCP Orchestrator ===
- Pipeline编排: 顺序执行多步骤安全测试 (依赖感知)
- Parallel执行: 并行运行独立安全任务
- 智能路由: 自动选择 HOS-Forge / Burp / SecurityHub
- 3个预定义模板:
* quick_recon: 快速侦察 (nmap+subfinder+whois)
* web_audit: Web审计 (nmap+nuclei+burp+sqlmap)
* full_pentest: 完整渗透测试 (全流程PTES)
=== MCP工具注册 (新增7个桥接+编排端点) ===
- hos_mcp_discover — 发现外部MCP服务
- hos_mcp_connect — 连接外部MCP服务
- hos_burp_bridge — Burp桥接调用
- hos_security_hub_bridge — SecurityHub桥接
- hos_workflow_templates — 工作流模板列表
- hos_workflow_run — 执行安全工作流
- hos_parallel_scan — 并行安全扫描
架构:
AI Agent → HOS MCP Server → Bridge/Orchestrator → 三方MCP服务
↕
HOS-Forge 原生工具
Co-Authored-By: Claude <noreply@anthropic.com>
=== Removed ===
- Deleted hosforge/reality_enforcement/ (hardcoded HOS-Silly-Mock port)
- Added .agents/skills/hos-silly-mock/SKILL.md (remote skill reference only)
- Removed hos_reality_check MCP tool that depended on deleted module
=== Security Dashboard (React-ready) ===
- MCPTopologyWidget: service topology visualization
- VulnStatWidget: vulnerability statistics cards
- RiskScoreWidget: risk score bar
- PentestResultWidget: pentest phase grid
- RecentFindingsWidget: recent findings list
- Dashboard API: FastAPI router at /api/hos/dashboard/*
=== CI/CD Quality Gates ===
- GitHub Actions: hos-security-scan.yml (4 jobs)
- Pre-commit hooks: .pre-commit-config.yaml
- CLI: python -m hosforge.ci {check-reality|check-sast|install-hook|ci-scan}
- Score threshold: 50 (blocks build below)
Co-Authored-By: Claude <noreply@anthropic.com>
=== 报告生成架构升级 === 之前: Python f-string 拼接 HTML (含大量硬编码样式和数据) 之后: React CDN 单页模板 (零构建工具, 双击即预览) === 核心变更 === - 移除 Python 拼接 HTML 方式的所有硬编码数据 - 新增 CDN React 模板: react_report_template.html * React 18 + Babel Standalone (CDN, 无需 npm) * Chart.js 分布图 + highlight.js 代码高亮 * 漏洞生命周期管理 (待修复/已修复/忽略/误报) * 多级筛选 (严重级/类别/关键词) * 分页加载 (每页20条) * 一键导出 CSV - window.__HOS_REPORT_DATA__ 数据注入机制 - 无数据时显示空状态 + 注入指南 - 所有样式使用 CSS 变量 (安全风信子色板) === Python 适配 === - SecurityHtmlReporter.generate() 读取模板 + 注入真实数据 - SecurityHtmlReporter.save() 直接输出 .html - ReportMetadata 导入修复 - 零模板内 mock/vulns 计数 bug 修复 Co-Authored-By: Claude <noreply@anthropic.com>
=== 打包发布 === - 更新 pyproject.toml: 添加 [project.scripts] CLI 入口点 * hos-mcp — MCP Server (端口 8321) * hos-ci — CI/CD 安全检查 * hos-report — 安全报告生成 * hos-dashboard — Dashboard API 服务 - 新增 setup.py pip 兼容入口 - 更新 MANIFEST.in: 包含模板文件 - 新增 RELEASE.md 版本发布文档 - 修复若干 import 错误 === 验证 === - 全部 8 个 hosforge 子模块导入通过 - 4 个 CLI 入口点均可正常调用 - MIT 开源协议 Co-Authored-By: Claude <noreply@anthropic.com>
=== 部署方式 (对标 openhands.dev) === 1) pip install (源码安装) pip install -e . python -m hosforge mcp 2) Docker (容器化部署) docker compose -f docker-compose.hos.yml build docker compose -f docker-compose.hos.yml up hos-forge-mcp 3) Makefile (开发/生产) make hos-mcp # 启动 MCP Server make hos-docker-run # Docker 运行 make hos-ci # CI 安全检查 4) CLI 入口 (4个命令) hos-mcp MCP Server (:8321) hos-ci CI/CD 安全检查 hos-report 安全报告生成 hos-dashboard Dashboard API === 修复 === - FastMCP 兼容: 移除 emoji/description 中的非 ASCII - 移除 **kwargs 工具函数 (FastMCP 不支持) - 添加 python -m hosforge 主入口 - 添加 Dockerfile.hos + docker-compose.hos.yml - 修复 .dockerignore 排除 .agents 目录的问题 - 验证: 19 个 MCP 工具全部注册通过 Co-Authored-By: Claude <noreply@anthropic.com>
Bumps the eslint group in /frontend with 7 updates: | Package | From | To | | --- | --- | --- | | [@tanstack/eslint-plugin-query](https://github.com/TanStack/query/tree/HEAD/packages/eslint-plugin-query) | `5.100.10` | `5.101.2` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `7.18.0` | `8.64.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `7.18.0` | `8.64.0` | | [eslint](https://github.com/eslint/eslint) | `8.57.1` | `10.7.0` | | [eslint-plugin-i18next](https://github.com/edvardchen/eslint-plugin-i18next) | `6.1.4` | `6.1.5` | | [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) | `5.5.5` | `5.5.6` | | [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `4.6.2` | `7.1.1` | Updates `@tanstack/eslint-plugin-query` from 5.100.10 to 5.101.2 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/eslint-plugin-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/eslint-plugin-query@5.101.2/packages/eslint-plugin-query) Updates `@typescript-eslint/eslint-plugin` from 7.18.0 to 8.64.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 7.18.0 to 8.64.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/parser) Updates `eslint` from 8.57.1 to 10.7.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v8.57.1...v10.7.0) Updates `eslint-plugin-i18next` from 6.1.4 to 6.1.5 - [Changelog](https://github.com/edvardchen/eslint-plugin-i18next/blob/main/CHANGELOG.md) - [Commits](edvardchen/eslint-plugin-i18next@v6.1.4...v6.1.5) Updates `eslint-plugin-prettier` from 5.5.5 to 5.5.6 - [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases) - [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md) - [Commits](prettier/eslint-plugin-prettier@v5.5.5...v5.5.6) Updates `eslint-plugin-react-hooks` from 4.6.2 to 7.1.1 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/eslint-plugin-react-hooks@7.1.1/packages/eslint-plugin-react-hooks) --- updated-dependencies: - dependency-name: "@tanstack/eslint-plugin-query" dependency-version: 5.101.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: eslint - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.64.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: eslint - dependency-name: "@typescript-eslint/parser" dependency-version: 8.64.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: eslint - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: eslint - dependency-name: eslint-plugin-i18next dependency-version: 6.1.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: eslint - dependency-name: eslint-plugin-prettier dependency-version: 5.5.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: eslint - dependency-name: eslint-plugin-react-hooks dependency-version: 7.1.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: eslint ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
👋 Thanks for opening this PR! Before review, please add a short note in the Please put that note between |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the eslint group in /frontend with 7 updates:
5.100.105.101.27.18.08.64.07.18.08.64.08.57.110.7.06.1.46.1.55.5.55.5.64.6.27.1.1Updates
@tanstack/eslint-plugin-queryfrom 5.100.10 to 5.101.2Release notes
Sourced from @tanstack/eslint-plugin-query's releases.
Changelog
Sourced from @tanstack/eslint-plugin-query's changelog.
Commits
Updates
@typescript-eslint/eslint-pluginfrom 7.18.0 to 8.64.0Release notes
Sourced from @typescript-eslint/eslint-plugin's releases.
... (truncated)
Changelog
Sourced from @typescript-eslint/eslint-plugin's changelog.
... (truncated)
Commits
414d9abchore(release): publish 8.64.0bcfe16ffeat(eslint-plugin): [no-loop-func] supportusing/await usingdeclarati...5b5bfdefix(eslint-plugin): [require-array-sort-compare] handle constrained arrays (#...321856cchore: cleanup cspell config (#12526)b418cf5feat(typescript-estree): throw for invalid definite assignment in class prope...737de2bdocs: align unified-signatures correct example parameter (#12506)a63c17adocs: fix shadowed parameter name in unified-signatures example (#12502)290cf6cchore(release): publish 8.63.08d8fda6feat(eslint-plugin): [no-misused-promises] detect async usage of a sync dispo...fec4f4ffix(eslint-plugin): [no-base-to-string] don't flag a shadowed String() call (...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@typescript-eslint/eslint-pluginsince your current version.Updates
@typescript-eslint/parserfrom 7.18.0 to 8.64.0Release notes
Sourced from @typescript-eslint/parser's releases.
... (truncated)
Changelog
Sourced from @typescript-eslint/parser's changelog.
... (truncated)
Commits
414d9abchore(release): publish 8.64.0290cf6cchore(release): publish 8.63.03ea32f4chore(release): publish 8.62.154e2857chore(release): publish 8.62.081e4c26feat: remove redundant package.json "files" (#12444)aaad718chore(release): publish 8.61.116a5b24chore(release): publish 8.61.04f84a69chore(release): publish 8.60.11849b53chore: typecheck using tsgo (#12139)f891c29chore(release): publish 8.60.0Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@typescript-eslint/parsersince your current version.Updates
eslintfrom 8.57.1 to 10.7.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
fabd99b10.7.037c5e75Build: changelog update for 10.7.09489379chore: update dependency@eslint/eslintrcto ^3.3.6 (#21076)81a4774chore: updates for v9.39.5 release3e7bf15fix: applyignoreClassesWithImplementsto class expressions (#21069)9835414chore: enable$ExpectTypeannotations in all TypeScript files (#21071)cf2a9bffeat: add errorClassNames option to preserve-caught-error rule (#21032)c30d808docs: Update READMEf8b873afeat: max-nested-callbacks option for constructor callbacks (#21063)72adf6bchore: restrictmarkdownlint-cli2updates in renovate (#21067)Updates
eslint-plugin-i18nextfrom 6.1.4 to 6.1.5Changelog
Sourced from eslint-plugin-i18next's changelog.
Commits
afe9e87chore(release): 6.1.57a6794fMerge pull request #160 from mrginglymus/rm-lodash27a7996chore(deps): swap lodash for native object spread5ff15a8Merge pull request #159 from edvardchen/fix-ellipsis-detection-138a3d5198fix: detect strings ending with ellipsisUpdates
eslint-plugin-prettierfrom 5.5.5 to 5.5.6Release notes
Sourced from eslint-plugin-prettier's releases.
Changelog
Sourced from eslint-plugin-prettier's changelog.
Commits
4f33ea5chore: release eslint-plugin-prettier (#792)4745b54ci: declare workflow-level contents: read on 2 workflows (#790)b5c96a3chore: bump all (dev)Dependencies (#791)e867680chore(deps): update all dependencies (#766)e8e2f7fchore: testing eslint v10 (#779)ca076d9chore: update dev dependencies (#780)42e6369build(deps): Bump the actions group with 2 updates (#778)53ff214Remove empty NPM_TOKEN from release.ymlUpdates
eslint-plugin-react-hooksfrom 4.6.2 to 7.1.1Release notes
Sourced from eslint-plugin-react-hooks's releases.
Changelog
Sourced from eslint-plugin-react-hooks's changelog.
... (truncated)
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions