This page collects WhisperX intelligence signals tagged #lockfile. It is designed for humans, search engines, and AI agents: each item links to a canonical source-backed record with sector, source, timestamp, credibility, and exportable structured data.
开源安全工具 Dependi-LSP 完成了一项关键升级，其扫描引擎现在能够解析并利用项目锁文件，以精确识别包括传递性依赖在内的软件漏洞。这项功能解决了长期以来依赖扫描工具的一个盲点：许多安全漏洞并非直接由项目引用的库引入，而是通过这些直接依赖项所依赖的更深层库（即传递性依赖）间接引入。传统扫描方法可能遗漏这些隐藏风险，而新功能通过构建依赖关系图，实现了对漏洞的完整溯源。 此次更新引入了 `LockfileGraph` 和 `LockfilePackage` 数据结构，并采用防循环的深度优先搜索算法及反向索引，将传递性漏洞归因的计算复杂度从潜在的 O(T×D×N) 优化至 O(T+D×N)。核心突破在于新增了对 9 种主流锁文件格...
A critical security regression has been identified in a project's dependency management, leaving systems using `npm install` exposed to a known HTML injection vulnerability. Despite a previous fix that correctly updated the pnpm override to require `hono@>=4.12.14`, the `package-lock.json` file was never regenerated. T...