更新: 109 个文件 - 2026-03-18 10:55:52
这个提交包含在：
hao
@@ -87,7 +87,7 @@
|
||||
<h1>当前架构库镜像</h1>
|
||||
<div class="meta">工作台内置镜像页：当前架构库结构化数据镜像。</div>
|
||||
<pre>{
|
||||
"generated_at": "2026-03-18T14:45:55+00:00",
|
||||
"generated_at": "2026-03-18T17:52:49+00:00",
|
||||
"title": "当前架构库",
|
||||
"summary": "工作台、控制面、数据层、授权边界与系统覆盖的当前真值视图。",
|
||||
"sections": [
|
||||
@@ -119,7 +119,7 @@
|
||||
},
|
||||
{
|
||||
"label": "当前漏洞条目",
|
||||
"value": "5"
|
||||
"value": "0"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
@@ -137,7 +137,7 @@
|
||||
},
|
||||
{
|
||||
"label": "生成时间",
|
||||
"value": "2026-03-18T14:45:55+00:00"
|
||||
"value": "2026-03-18T17:52:49+00:00"
|
||||
}
|
||||
],
|
||||
"links": [
|
||||
@@ -356,6 +356,16 @@
|
||||
"href": "/docs/source-map.html",
|
||||
"description": "系统覆盖、来源和输出目录真值。"
|
||||
},
|
||||
{
|
||||
"label": "source catalog audit",
|
||||
"href": "/docs/source-catalog-audit.html",
|
||||
"description": "active/retired source 审计、替代关系与覆盖摘要。"
|
||||
},
|
||||
{
|
||||
"label": "retired sources",
|
||||
"href": "/docs/retired-sources.html",
|
||||
"description": "退役源、退役原因与 replacement map。"
|
||||
},
|
||||
{
|
||||
"label": "repro-map 真值",
|
||||
"href": "/docs/repro-map.html",
|
||||
@@ -386,6 +396,21 @@
|
||||
"href": "/data/completeness.json",
|
||||
"description": "最新 advisory 完整度、系统/family 进度与 ingest 健康度。"
|
||||
},
|
||||
{
|
||||
"label": "source-health.json",
|
||||
"href": "/data/source-health.json",
|
||||
"description": "active source 健康度、系统分布与失败分类。"
|
||||
},
|
||||
{
|
||||
"label": "alerts.json",
|
||||
"href": "/data/alerts.json",
|
||||
"description": "source 告警状态机、failure streak 与 resolved 记录。"
|
||||
},
|
||||
{
|
||||
"label": "monitor-summary.json",
|
||||
"href": "/data/monitor-summary.json",
|
||||
"description": "每日监控摘要、open alerts 与最近全绿时间。"
|
||||
},
|
||||
{
|
||||
"label": "runs.json",
|
||||
"href": "/runs.json",
|
||||
@@ -410,6 +435,11 @@
|
||||
"label": "architecture.json",
|
||||
"href": "/architecture.json",
|
||||
"description": "当前架构库结构化 JSON。"
|
||||
},
|
||||
{
|
||||
"label": "source-catalog-audit.json",
|
||||
"href": "/data/source-catalog-audit.json",
|
||||
"description": "source catalog 审计真值与 retired/replacement 关系。"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
@@ -572,7 +602,7 @@
|
||||
"open": false,
|
||||
"badges": [
|
||||
"近两年全量",
|
||||
"官方源 2",
|
||||
"官方源 3",
|
||||
"生态源 0",
|
||||
"研究源 0"
|
||||
],
|
||||
@@ -606,7 +636,7 @@
|
||||
"fields": [
|
||||
{
|
||||
"label": "官方来源",
|
||||
"value": "Discourse Meta Security\nGitHub Discourse Advisories"
|
||||
"value": "Discourse Meta Security\nDiscourse Release Notes RSS\nGitHub Discourse Advisories"
|
||||
},
|
||||
{
|
||||
"label": "生态来源",
|
||||
@@ -658,7 +688,7 @@
|
||||
"badges": [
|
||||
"历史全量",
|
||||
"官方源 2",
|
||||
"生态源 1",
|
||||
"生态源 2",
|
||||
"研究源 0"
|
||||
],
|
||||
"fields": [
|
||||
@@ -695,7 +725,7 @@
|
||||
},
|
||||
{
|
||||
"label": "生态来源",
|
||||
"value": "Drupal Security Advisories Site"
|
||||
"value": "Drupal Security Advisories Site\nGHSA Drupal Core"
|
||||
},
|
||||
{
|
||||
"label": "研究来源",
|
||||
@@ -1528,7 +1558,7 @@
|
||||
"open": false,
|
||||
"badges": [
|
||||
"近两年全量",
|
||||
"官方源 2",
|
||||
"官方源 4",
|
||||
"生态源 0",
|
||||
"研究源 0"
|
||||
],
|
||||
@@ -1562,7 +1592,7 @@
|
||||
"fields": [
|
||||
{
|
||||
"label": "官方来源",
|
||||
"value": "Django Security RSS\nOSV Django"
|
||||
"value": "Django Security RSS\nDjango Security Weblog\nDjango Security Releases Archive\nOSV Django"
|
||||
},
|
||||
{
|
||||
"label": "生态来源",
|
||||
@@ -4800,7 +4830,7 @@
|
||||
"open": false,
|
||||
"badges": [
|
||||
"近两年全量",
|
||||
"官方源 2",
|
||||
"官方源 3",
|
||||
"生态源 0",
|
||||
"研究源 0"
|
||||
],
|
||||
@@ -4834,7 +4864,7 @@
|
||||
"fields": [
|
||||
{
|
||||
"label": "官方来源",
|
||||
"value": "HAProxy Security Advisories\nNVD HAProxy"
|
||||
"value": "HAProxy Security Advisories\nHAProxy Blog Feed\nNVD HAProxy"
|
||||
},
|
||||
{
|
||||
"label": "生态来源",
|
||||
@@ -5076,8 +5106,8 @@
|
||||
"open": false,
|
||||
"badges": [
|
||||
"历史全量",
|
||||
"官方源 2",
|
||||
"生态源 1",
|
||||
"官方源 3",
|
||||
"生态源 2",
|
||||
"研究源 0"
|
||||
],
|
||||
"fields": [
|
||||
@@ -5110,11 +5140,11 @@
|
||||
"fields": [
|
||||
{
|
||||
"label": "官方来源",
|
||||
"value": "Adobe Security Bulletins\nNVD Adobe Commerce"
|
||||
"value": "Adobe Security Bulletins\nAdobe Magento Security Index\nNVD Adobe Commerce"
|
||||
},
|
||||
{
|
||||
"label": "生态来源",
|
||||
"value": "Sansec Research"
|
||||
"value": "GHSA Adobe Commerce\nSansec Research"
|
||||
},
|
||||
{
|
||||
"label": "研究来源",
|
||||
@@ -5945,15 +5975,15 @@
|
||||
},
|
||||
{
|
||||
"label": "Advisory 数",
|
||||
"value": "5"
|
||||
"value": "0"
|
||||
},
|
||||
{
|
||||
"label": "状态类型",
|
||||
"value": "1"
|
||||
"value": "0"
|
||||
},
|
||||
{
|
||||
"label": "最近失败",
|
||||
"value": "5"
|
||||
"value": "0"
|
||||
}
|
||||
],
|
||||
"items": [
|
||||
@@ -5961,23 +5991,7 @@
|
||||
"title": "状态分布",
|
||||
"summary": "verification_status 当前计数。",
|
||||
"open": false,
|
||||
"items": [
|
||||
{
|
||||
"title": "人工分诊",
|
||||
"summary": "当前累计 5 条。",
|
||||
"open": false,
|
||||
"fields": [
|
||||
{
|
||||
"label": "状态编码",
|
||||
"value": "triage-manual"
|
||||
},
|
||||
{
|
||||
"label": "数量",
|
||||
"value": "5"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
"items": []
|
||||
},
|
||||
{
|
||||
"title": "最近失败",
|
||||
@@ -5985,134 +5999,9 @@
|
||||
"open": false,
|
||||
"items": [
|
||||
{
|
||||
"title": "Next.js: Unbounded postponed resume buffering can lead to DoS",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-27979"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Next.js: Unbounded next/image disk cache growth can exhaust storage",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-27980"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Next.js: HTTP request smuggling in rewrites",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-29057"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Next.js: null origin can bypass Server Actions CSRF checks",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-27978"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Next.js: null origin can bypass dev HMR websocket CSRF checks",
|
||||
"summary": "无额外阻塞说明。",
|
||||
"open": false,
|
||||
"badges": [
|
||||
"人工分诊"
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"label": "运行 ID",
|
||||
"value": "-"
|
||||
},
|
||||
{
|
||||
"label": "漏洞条目",
|
||||
"value": "nextjs--CVE-2026-27977"
|
||||
},
|
||||
{
|
||||
"label": "状态",
|
||||
"value": "人工分诊"
|
||||
},
|
||||
{
|
||||
"label": "阻塞原因",
|
||||
"value": "-"
|
||||
}
|
||||
]
|
||||
"title": "暂无失败样本",
|
||||
"summary": "当前 summary.json 中没有 recent_failures。",
|
||||
"open": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -125,7 +125,7 @@
|
||||
| Medusa | `ecommerce` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Moodle | `cms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| NestJS | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Next.js | `frameworks` | `history-full` | `yes` | `yes` | `5` | `5` | `3` | `seeded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `2026-03-17T16:31:34.160932Z` |
|
||||
| Next.js | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Nginx | `servers` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Node.js | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Nuxt | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
|
||||
@@ -0,0 +1,539 @@
|
||||
<!doctype html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Retired Sources & Replacement Map</title>
|
||||
<style>
|
||||
:root {
|
||||
--bg: #08111f;
|
||||
--panel: rgba(9, 18, 32, 0.9);
|
||||
--border: rgba(137, 171, 214, 0.2);
|
||||
--text: #f7fafc;
|
||||
--muted: #9fb3ca;
|
||||
--accent: #5eead4;
|
||||
}
|
||||
* { box-sizing: border-box; }
|
||||
body {
|
||||
margin: 0;
|
||||
min-height: 100vh;
|
||||
font-family: "IBM Plex Sans", "Segoe UI", sans-serif;
|
||||
color: var(--text);
|
||||
background:
|
||||
radial-gradient(circle at top left, rgba(94, 234, 212, 0.12), transparent 26%),
|
||||
linear-gradient(160deg, #050c16 0%, #091526 50%, #10233d 100%);
|
||||
}
|
||||
main {
|
||||
max-width: 1080px;
|
||||
margin: 0 auto;
|
||||
padding: 32px 20px 40px;
|
||||
}
|
||||
.panel {
|
||||
background: var(--panel);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: 20px;
|
||||
padding: 24px;
|
||||
box-shadow: 0 24px 80px rgba(1, 7, 20, 0.45);
|
||||
}
|
||||
.actions {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: 12px;
|
||||
margin-bottom: 18px;
|
||||
}
|
||||
.chip {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 8px;
|
||||
border-radius: 999px;
|
||||
border: 1px solid var(--border);
|
||||
padding: 10px 14px;
|
||||
color: var(--text);
|
||||
background: rgba(255,255,255,0.05);
|
||||
text-decoration: none;
|
||||
}
|
||||
.chip:hover { border-color: rgba(94, 234, 212, 0.42); }
|
||||
h1 {
|
||||
margin: 0 0 12px;
|
||||
font-family: "IBM Plex Serif", Georgia, serif;
|
||||
font-size: clamp(1.8rem, 4vw, 3rem);
|
||||
line-height: 1.08;
|
||||
}
|
||||
.meta {
|
||||
color: var(--muted);
|
||||
margin-bottom: 18px;
|
||||
}
|
||||
pre {
|
||||
margin: 0;
|
||||
padding: 20px;
|
||||
overflow: auto;
|
||||
border-radius: 16px;
|
||||
border: 1px solid rgba(137, 171, 214, 0.12);
|
||||
background: rgba(2, 8, 22, 0.84);
|
||||
color: #d6e5f5;
|
||||
font-family: "IBM Plex Mono", "SFMono-Regular", monospace;
|
||||
font-size: 0.92rem;
|
||||
line-height: 1.6;
|
||||
white-space: pre-wrap;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<div class="panel">
|
||||
<div class="actions">
|
||||
<a class="chip" href="/overview/index.html">返回工作台</a>
|
||||
</div>
|
||||
<h1>Retired Sources & Replacement Map</h1>
|
||||
<div class="meta">工作台内置镜像页：退役源、退役原因和 replacement_sources 真值。</div>
|
||||
<pre>[
|
||||
{
|
||||
"system_id": "adobe-commerce",
|
||||
"display_name": "Adobe Commerce",
|
||||
"source_name": "Adobe Security Bulletins",
|
||||
"bucket": "official_sources",
|
||||
"kind": "html-links",
|
||||
"retired_reason": "Original bulletin index probe was unstable under the old transport path; vendor index replacement uses explicit request policy and parser hints.",
|
||||
"replacement_sources": [
|
||||
"Adobe Magento Security Index",
|
||||
"NVD Adobe Commerce",
|
||||
"GHSA Adobe Commerce"
|
||||
],
|
||||
"url": "https://helpx.adobe.com/security/products/magento.html"
|
||||
},
|
||||
{
|
||||
"system_id": "adobe-commerce",
|
||||
"display_name": "Adobe Commerce",
|
||||
"source_name": "GHSA Adobe Commerce",
|
||||
"bucket": "ecosystem_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; Adobe index and NVD remain active replacements.",
|
||||
"replacement_sources": [
|
||||
"Adobe Magento Security Index",
|
||||
"NVD Adobe Commerce"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "adobe-commerce",
|
||||
"display_name": "Adobe Commerce",
|
||||
"source_name": "Sansec Research",
|
||||
"bucket": "ecosystem_sources",
|
||||
"kind": "vendor-index",
|
||||
"retired_reason": "Research index is too slow for daily active monitoring; GHSA Adobe Commerce provides a stable machine-readable replacement.",
|
||||
"replacement_sources": [
|
||||
"GHSA Adobe Commerce",
|
||||
"Adobe Magento Security Index"
|
||||
],
|
||||
"url": "https://sansec.io/research"
|
||||
},
|
||||
{
|
||||
"system_id": "angular",
|
||||
"display_name": "Angular",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Angular remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV Angular"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "astro",
|
||||
"display_name": "Astro",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Astro remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV Astro"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "discourse",
|
||||
"display_name": "Discourse",
|
||||
"source_name": "Discourse Meta Security",
|
||||
"bucket": "official_sources",
|
||||
"kind": "html-links",
|
||||
"retired_reason": "Meta security category HTML changed and no longer provides stable scrape semantics for health checks.",
|
||||
"replacement_sources": [
|
||||
"Discourse Release Notes RSS",
|
||||
"GitHub Discourse Advisories"
|
||||
],
|
||||
"url": "https://meta.discourse.org/c/bug/security/40"
|
||||
},
|
||||
{
|
||||
"system_id": "discourse",
|
||||
"display_name": "Discourse",
|
||||
"source_name": "GitHub Discourse Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; Discourse release feed remains the active official source.",
|
||||
"replacement_sources": [
|
||||
"Discourse Release Notes RSS"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "django",
|
||||
"display_name": "Django",
|
||||
"source_name": "Django Security RSS",
|
||||
"bucket": "official_sources",
|
||||
"kind": "rss-feed",
|
||||
"retired_reason": "Official security tag feed became unstable; use official weblog index and release archive instead.",
|
||||
"replacement_sources": [
|
||||
"Django Security Weblog",
|
||||
"Django Security Releases Archive"
|
||||
],
|
||||
"url": "https://www.djangoproject.com/weblog/feeds/tags/security/"
|
||||
},
|
||||
{
|
||||
"system_id": "drupal",
|
||||
"display_name": "Drupal",
|
||||
"source_name": "Drupal Security Advisories Site",
|
||||
"bucket": "ecosystem_sources",
|
||||
"kind": "html-links",
|
||||
"retired_reason": "Drupal security index page became unstable for repeated HTML scraping; RSS + GHSA replacement is used for active monitoring.",
|
||||
"replacement_sources": [
|
||||
"Drupal Security Advisories RSS",
|
||||
"GHSA Drupal Core"
|
||||
],
|
||||
"url": "https://www.drupal.org/security"
|
||||
},
|
||||
{
|
||||
"system_id": "drupal",
|
||||
"display_name": "Drupal",
|
||||
"source_name": "GHSA Drupal Core",
|
||||
"bucket": "ecosystem_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; RSS and NVD remain active replacements.",
|
||||
"replacement_sources": [
|
||||
"Drupal Security Advisories RSS",
|
||||
"NVD Drupal"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "esbuild",
|
||||
"display_name": "esbuild",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV esbuild remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV esbuild"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "express",
|
||||
"display_name": "Express",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Express remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV Express"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "fastify",
|
||||
"display_name": "Fastify",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Fastify remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV Fastify"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "flask",
|
||||
"display_name": "Flask",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GitHub advisory API is quota-limited; OSV Flask remains the active machine-readable source.",
|
||||
"replacement_sources": [
|
||||
"OSV Flask"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "hapi",
|
||||
"display_name": "Hapi",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Hapi remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV Hapi"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "haproxy",
|
||||
"display_name": "HAProxy",
|
||||
"source_name": "HAProxy Security Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "html-links",
|
||||
"retired_reason": "Legacy haproxy.org security page no longer yields stable scrape results for monitoring.",
|
||||
"replacement_sources": [
|
||||
"HAProxy Blog Feed"
|
||||
],
|
||||
"url": "https://www.haproxy.org/security/"
|
||||
},
|
||||
{
|
||||
"system_id": "koa",
|
||||
"display_name": "Koa",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Koa remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV Koa"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "laravel",
|
||||
"display_name": "Laravel",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GitHub advisory API is quota-limited; OSV Laravel remains the active machine-readable source.",
|
||||
"replacement_sources": [
|
||||
"OSV Laravel"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "mattermost",
|
||||
"display_name": "Mattermost",
|
||||
"source_name": "Mattermost Security Updates",
|
||||
"bucket": "official_sources",
|
||||
"kind": "html-links",
|
||||
"retired_reason": "Mattermost security updates page returned repeated 403 responses from the collector path; NVD replacement remains active.",
|
||||
"replacement_sources": [
|
||||
"NVD Mattermost"
|
||||
],
|
||||
"url": "https://mattermost.com/security-updates/"
|
||||
},
|
||||
{
|
||||
"system_id": "mediawiki",
|
||||
"display_name": "MediaWiki",
|
||||
"source_name": "MediaWiki Security Releases",
|
||||
"bucket": "official_sources",
|
||||
"kind": "html-links",
|
||||
"retired_reason": "MediaWiki security page is no longer reachable reliably from the collector path; NVD replacement remains active.",
|
||||
"replacement_sources": [
|
||||
"NVD MediaWiki"
|
||||
],
|
||||
"url": "https://www.mediawiki.org/wiki/Security"
|
||||
},
|
||||
{
|
||||
"system_id": "moodle",
|
||||
"display_name": "Moodle",
|
||||
"source_name": "Moodle Security News",
|
||||
"bucket": "official_sources",
|
||||
"kind": "html-links",
|
||||
"retired_reason": "Moodle security page returned repeated 403 responses from the collector path; NVD replacement remains active.",
|
||||
"replacement_sources": [
|
||||
"NVD Moodle"
|
||||
],
|
||||
"url": "https://moodle.org/security/"
|
||||
},
|
||||
{
|
||||
"system_id": "nestjs",
|
||||
"display_name": "NestJS",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV NestJS remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV NestJS"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "nextjs",
|
||||
"display_name": "Next.js",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; GitHub Next.js Advisories and OSV Next.js remain active replacements.",
|
||||
"replacement_sources": [
|
||||
"GitHub Next.js Advisories",
|
||||
"OSV Next.js"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "nuxt",
|
||||
"display_name": "Nuxt",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; Nuxt Security and OSV Nuxt remain active replacements.",
|
||||
"replacement_sources": [
|
||||
"Nuxt Security",
|
||||
"OSV Nuxt"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "rails",
|
||||
"display_name": "Ruby on Rails",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GitHub advisory API is quota-limited; OSV Rails remains the active machine-readable source.",
|
||||
"replacement_sources": [
|
||||
"OSV Rails"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "react",
|
||||
"display_name": "React",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; GitHub React Advisories and OSV React remain active replacements.",
|
||||
"replacement_sources": [
|
||||
"GitHub React Advisories",
|
||||
"OSV React"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "spring-boot",
|
||||
"display_name": "Spring Boot",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GitHub advisory API is quota-limited; Spring official security page remains the active source.",
|
||||
"replacement_sources": [
|
||||
"Spring Security Advisories"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "spring-framework",
|
||||
"display_name": "Spring Framework",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; Spring Security Advisories remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"Spring Security Advisories"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "spring-security",
|
||||
"display_name": "Spring Security",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GitHub advisory API is quota-limited; Spring official security page remains the active source.",
|
||||
"replacement_sources": [
|
||||
"Spring Security Advisories"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "sveltekit",
|
||||
"display_name": "SvelteKit",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV SvelteKit remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV SvelteKit"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "symfony",
|
||||
"display_name": "Symfony",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GitHub advisory API is quota-limited; OSV Symfony remains the active machine-readable source.",
|
||||
"replacement_sources": [
|
||||
"OSV Symfony"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "undici",
|
||||
"display_name": "Undici",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Undici remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV Undici"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "vite",
|
||||
"display_name": "Vite",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; Vite Security and OSV Vite remain active replacements.",
|
||||
"replacement_sources": [
|
||||
"Vite Security",
|
||||
"OSV Vite"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "vue",
|
||||
"display_name": "Vue",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; Vue Security and OSV Vue remain active replacements.",
|
||||
"replacement_sources": [
|
||||
"Vue Security",
|
||||
"OSV Vue"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "webpack",
|
||||
"display_name": "webpack",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV webpack remains the active replacement source.",
|
||||
"replacement_sources": [
|
||||
"OSV webpack"
|
||||
],
|
||||
"url": ""
|
||||
},
|
||||
{
|
||||
"system_id": "werkzeug",
|
||||
"display_name": "Werkzeug",
|
||||
"source_name": "GitHub Global Advisories",
|
||||
"bucket": "official_sources",
|
||||
"kind": "ghsa-global",
|
||||
"retired_reason": "Unauthenticated GitHub advisory API is quota-limited; OSV Werkzeug remains the active machine-readable source.",
|
||||
"replacement_sources": [
|
||||
"OSV Werkzeug"
|
||||
],
|
||||
"url": ""
|
||||
}
|
||||
]</pre>
|
||||
</div>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,141 @@
|
||||
<!doctype html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Source Catalog Audit</title>
|
||||
<style>
|
||||
:root {
|
||||
--bg: #08111f;
|
||||
--panel: rgba(9, 18, 32, 0.9);
|
||||
--border: rgba(137, 171, 214, 0.2);
|
||||
--text: #f7fafc;
|
||||
--muted: #9fb3ca;
|
||||
--accent: #5eead4;
|
||||
}
|
||||
* { box-sizing: border-box; }
|
||||
body {
|
||||
margin: 0;
|
||||
min-height: 100vh;
|
||||
font-family: "IBM Plex Sans", "Segoe UI", sans-serif;
|
||||
color: var(--text);
|
||||
background:
|
||||
radial-gradient(circle at top left, rgba(94, 234, 212, 0.12), transparent 26%),
|
||||
linear-gradient(160deg, #050c16 0%, #091526 50%, #10233d 100%);
|
||||
}
|
||||
main {
|
||||
max-width: 1080px;
|
||||
margin: 0 auto;
|
||||
padding: 32px 20px 40px;
|
||||
}
|
||||
.panel {
|
||||
background: var(--panel);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: 20px;
|
||||
padding: 24px;
|
||||
box-shadow: 0 24px 80px rgba(1, 7, 20, 0.45);
|
||||
}
|
||||
.actions {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: 12px;
|
||||
margin-bottom: 18px;
|
||||
}
|
||||
.chip {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 8px;
|
||||
border-radius: 999px;
|
||||
border: 1px solid var(--border);
|
||||
padding: 10px 14px;
|
||||
color: var(--text);
|
||||
background: rgba(255,255,255,0.05);
|
||||
text-decoration: none;
|
||||
}
|
||||
.chip:hover { border-color: rgba(94, 234, 212, 0.42); }
|
||||
h1 {
|
||||
margin: 0 0 12px;
|
||||
font-family: "IBM Plex Serif", Georgia, serif;
|
||||
font-size: clamp(1.8rem, 4vw, 3rem);
|
||||
line-height: 1.08;
|
||||
}
|
||||
.meta {
|
||||
color: var(--muted);
|
||||
margin-bottom: 18px;
|
||||
}
|
||||
pre {
|
||||
margin: 0;
|
||||
padding: 20px;
|
||||
overflow: auto;
|
||||
border-radius: 16px;
|
||||
border: 1px solid rgba(137, 171, 214, 0.12);
|
||||
background: rgba(2, 8, 22, 0.84);
|
||||
color: #d6e5f5;
|
||||
font-family: "IBM Plex Mono", "SFMono-Regular", monospace;
|
||||
font-size: 0.92rem;
|
||||
line-height: 1.6;
|
||||
white-space: pre-wrap;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<div class="panel">
|
||||
<div class="actions">
|
||||
<a class="chip" href="/overview/index.html">返回工作台</a>
|
||||
</div>
|
||||
<h1>Source Catalog Audit</h1>
|
||||
<div class="meta">工作台内置镜像页：active/retired source、replacement map 与覆盖摘要。</div>
|
||||
<pre># Source Catalog Audit
|
||||
|
||||
- generated_at: `2026-03-18T17:41:42+00:00`
|
||||
- systems: `62`
|
||||
- sources: `146`
|
||||
- active_sources: `110`
|
||||
- retired_sources: `36`
|
||||
- systems_with_active_official: `62/62`
|
||||
- systems_with_machine_readable_source: `57/62`
|
||||
|
||||
## Retired Sources
|
||||
|
||||
- `adobe-commerce` `Adobe Security Bulletins` -> replacements: `Adobe Magento Security Index, NVD Adobe Commerce, GHSA Adobe Commerce` | reason: Original bulletin index probe was unstable under the old transport path; vendor index replacement uses explicit request policy and parser hints.
|
||||
- `adobe-commerce` `GHSA Adobe Commerce` -> replacements: `Adobe Magento Security Index, NVD Adobe Commerce` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Adobe index and NVD remain active replacements.
|
||||
- `adobe-commerce` `Sansec Research` -> replacements: `GHSA Adobe Commerce, Adobe Magento Security Index` | reason: Research index is too slow for daily active monitoring; GHSA Adobe Commerce provides a stable machine-readable replacement.
|
||||
- `angular` `GitHub Global Advisories` -> replacements: `OSV Angular` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Angular remains the active replacement source.
|
||||
- `astro` `GitHub Global Advisories` -> replacements: `OSV Astro` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Astro remains the active replacement source.
|
||||
- `discourse` `Discourse Meta Security` -> replacements: `Discourse Release Notes RSS, GitHub Discourse Advisories` | reason: Meta security category HTML changed and no longer provides stable scrape semantics for health checks.
|
||||
- `discourse` `GitHub Discourse Advisories` -> replacements: `Discourse Release Notes RSS` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Discourse release feed remains the active official source.
|
||||
- `django` `Django Security RSS` -> replacements: `Django Security Weblog, Django Security Releases Archive` | reason: Official security tag feed became unstable; use official weblog index and release archive instead.
|
||||
- `drupal` `Drupal Security Advisories Site` -> replacements: `Drupal Security Advisories RSS, GHSA Drupal Core` | reason: Drupal security index page became unstable for repeated HTML scraping; RSS + GHSA replacement is used for active monitoring.
|
||||
- `drupal` `GHSA Drupal Core` -> replacements: `Drupal Security Advisories RSS, NVD Drupal` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; RSS and NVD remain active replacements.
|
||||
- `esbuild` `GitHub Global Advisories` -> replacements: `OSV esbuild` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV esbuild remains the active replacement source.
|
||||
- `express` `GitHub Global Advisories` -> replacements: `OSV Express` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Express remains the active replacement source.
|
||||
- `fastify` `GitHub Global Advisories` -> replacements: `OSV Fastify` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Fastify remains the active replacement source.
|
||||
- `flask` `GitHub Global Advisories` -> replacements: `OSV Flask` | reason: Unauthenticated GitHub advisory API is quota-limited; OSV Flask remains the active machine-readable source.
|
||||
- `hapi` `GitHub Global Advisories` -> replacements: `OSV Hapi` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Hapi remains the active replacement source.
|
||||
- `haproxy` `HAProxy Security Advisories` -> replacements: `HAProxy Blog Feed` | reason: Legacy haproxy.org security page no longer yields stable scrape results for monitoring.
|
||||
- `koa` `GitHub Global Advisories` -> replacements: `OSV Koa` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Koa remains the active replacement source.
|
||||
- `laravel` `GitHub Global Advisories` -> replacements: `OSV Laravel` | reason: Unauthenticated GitHub advisory API is quota-limited; OSV Laravel remains the active machine-readable source.
|
||||
- `mattermost` `Mattermost Security Updates` -> replacements: `NVD Mattermost` | reason: Mattermost security updates page returned repeated 403 responses from the collector path; NVD replacement remains active.
|
||||
- `mediawiki` `MediaWiki Security Releases` -> replacements: `NVD MediaWiki` | reason: MediaWiki security page is no longer reachable reliably from the collector path; NVD replacement remains active.
|
||||
- `moodle` `Moodle Security News` -> replacements: `NVD Moodle` | reason: Moodle security page returned repeated 403 responses from the collector path; NVD replacement remains active.
|
||||
- `nestjs` `GitHub Global Advisories` -> replacements: `OSV NestJS` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV NestJS remains the active replacement source.
|
||||
- `nextjs` `GitHub Global Advisories` -> replacements: `GitHub Next.js Advisories, OSV Next.js` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; GitHub Next.js Advisories and OSV Next.js remain active replacements.
|
||||
- `nuxt` `GitHub Global Advisories` -> replacements: `Nuxt Security, OSV Nuxt` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Nuxt Security and OSV Nuxt remain active replacements.
|
||||
- `rails` `GitHub Global Advisories` -> replacements: `OSV Rails` | reason: Unauthenticated GitHub advisory API is quota-limited; OSV Rails remains the active machine-readable source.
|
||||
- `react` `GitHub Global Advisories` -> replacements: `GitHub React Advisories, OSV React` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; GitHub React Advisories and OSV React remain active replacements.
|
||||
- `spring-boot` `GitHub Global Advisories` -> replacements: `Spring Security Advisories` | reason: Unauthenticated GitHub advisory API is quota-limited; Spring official security page remains the active source.
|
||||
- `spring-framework` `GitHub Global Advisories` -> replacements: `Spring Security Advisories` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Spring Security Advisories remains the active replacement source.
|
||||
- `spring-security` `GitHub Global Advisories` -> replacements: `Spring Security Advisories` | reason: Unauthenticated GitHub advisory API is quota-limited; Spring official security page remains the active source.
|
||||
- `sveltekit` `GitHub Global Advisories` -> replacements: `OSV SvelteKit` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV SvelteKit remains the active replacement source.
|
||||
- `symfony` `GitHub Global Advisories` -> replacements: `OSV Symfony` | reason: Unauthenticated GitHub advisory API is quota-limited; OSV Symfony remains the active machine-readable source.
|
||||
- `undici` `GitHub Global Advisories` -> replacements: `OSV Undici` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Undici remains the active replacement source.
|
||||
- `vite` `GitHub Global Advisories` -> replacements: `Vite Security, OSV Vite` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Vite Security and OSV Vite remain active replacements.
|
||||
- `vue` `GitHub Global Advisories` -> replacements: `Vue Security, OSV Vue` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Vue Security and OSV Vue remain active replacements.
|
||||
- `webpack` `GitHub Global Advisories` -> replacements: `OSV webpack` | reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV webpack remains the active replacement source.
|
||||
- `werkzeug` `GitHub Global Advisories` -> replacements: `OSV Werkzeug` | reason: Unauthenticated GitHub advisory API is quota-limited; OSV Werkzeug remains the active machine-readable source.
|
||||
</pre>
|
||||
</div>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
@@ -174,6 +174,17 @@ systems:
|
||||
advisory_mode: module
|
||||
keywords: [drupal, module, sa-contrib]
|
||||
max_items: 50
|
||||
status: retired
|
||||
retired_reason: Drupal security index page became unstable for repeated HTML scraping; RSS + GHSA replacement is used for active monitoring.
|
||||
replacement_sources: [Drupal Security Advisories RSS, GHSA Drupal Core]
|
||||
- name: GHSA Drupal Core
|
||||
kind: ghsa-global
|
||||
ecosystem: composer
|
||||
confidence: ecosystem-authority
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; RSS and NVD remain active replacements.
|
||||
replacement_sources: [Drupal Security Advisories RSS, NVD Drupal]
|
||||
research_sources: []
|
||||
package_names:
|
||||
- ecosystem: composer
|
||||
@@ -325,6 +336,9 @@ systems:
|
||||
advisory_mode: core
|
||||
keywords: [mediawiki, security]
|
||||
max_items: 50
|
||||
status: retired
|
||||
retired_reason: MediaWiki security page is no longer reachable reliably from the collector path; NVD replacement remains active.
|
||||
replacement_sources: [NVD MediaWiki]
|
||||
- name: NVD MediaWiki
|
||||
kind: nvd-search
|
||||
keyword: MediaWiki
|
||||
@@ -355,6 +369,9 @@ systems:
|
||||
advisory_mode: core
|
||||
keywords: [moodle, security]
|
||||
max_items: 50
|
||||
status: retired
|
||||
retired_reason: Moodle security page returned repeated 403 responses from the collector path; NVD replacement remains active.
|
||||
replacement_sources: [NVD Moodle]
|
||||
- name: NVD Moodle
|
||||
kind: nvd-search
|
||||
keyword: Moodle
|
||||
@@ -385,13 +402,24 @@ systems:
|
||||
advisory_mode: core
|
||||
keywords: [discourse, security]
|
||||
max_items: 50
|
||||
- name: GitHub Discourse Advisories
|
||||
kind: html-links
|
||||
url: https://github.com/discourse/discourse/security/advisories
|
||||
status: retired
|
||||
retired_reason: Meta security category HTML changed and no longer provides stable scrape semantics for health checks.
|
||||
replacement_sources: [Discourse Release Notes RSS, GitHub Discourse Advisories]
|
||||
- name: Discourse Release Notes RSS
|
||||
kind: rss-feed
|
||||
url: https://meta.discourse.org/tag/release-notes.rss
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
keywords: [discourse]
|
||||
max_items: 50
|
||||
keywords: [discourse, security, cve]
|
||||
max_items: 60
|
||||
- name: GitHub Discourse Advisories
|
||||
kind: ghsa-global
|
||||
ecosystem: rubygems
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Discourse release feed remains the active official source.
|
||||
replacement_sources: [Discourse Release Notes RSS]
|
||||
ecosystem_sources: []
|
||||
research_sources: []
|
||||
package_names:
|
||||
@@ -418,6 +446,24 @@ systems:
|
||||
advisory_mode: core
|
||||
keywords: [adobe commerce, magento, apsb]
|
||||
max_items: 60
|
||||
status: retired
|
||||
retired_reason: Original bulletin index probe was unstable under the old transport path; vendor index replacement uses explicit request policy and parser hints.
|
||||
replacement_sources: [Adobe Magento Security Index, NVD Adobe Commerce, GHSA Adobe Commerce]
|
||||
- name: Adobe Magento Security Index
|
||||
kind: vendor-index
|
||||
url: https://helpx.adobe.com/security/products/magento.html
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
keywords: [adobe commerce, magento, apsb, security]
|
||||
max_items: 60
|
||||
request_policy:
|
||||
user_agent: python-requests/2.31.0
|
||||
timeout_seconds: 45
|
||||
verify_tls: false
|
||||
http_version: "1.1"
|
||||
parser_hints:
|
||||
keywords: [adobe commerce, magento, apsb, security]
|
||||
include_url_patterns: [magento, security, APSB]
|
||||
- name: NVD Adobe Commerce
|
||||
kind: nvd-search
|
||||
keyword: Adobe Commerce
|
||||
@@ -425,13 +471,24 @@ systems:
|
||||
advisory_mode: core
|
||||
results_per_page: 50
|
||||
ecosystem_sources:
|
||||
- name: GHSA Adobe Commerce
|
||||
kind: ghsa-global
|
||||
ecosystem: composer
|
||||
confidence: ecosystem-authority
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Adobe index and NVD remain active replacements.
|
||||
replacement_sources: [Adobe Magento Security Index, NVD Adobe Commerce]
|
||||
- name: Sansec Research
|
||||
kind: html-links
|
||||
kind: vendor-index
|
||||
url: https://sansec.io/research
|
||||
confidence: ecosystem-authority
|
||||
advisory_mode: extension
|
||||
keywords: [magento, adobe commerce]
|
||||
max_items: 50
|
||||
status: retired
|
||||
retired_reason: Research index is too slow for daily active monitoring; GHSA Adobe Commerce provides a stable machine-readable replacement.
|
||||
replacement_sources: [GHSA Adobe Commerce, Adobe Magento Security Index]
|
||||
research_sources: []
|
||||
package_names:
|
||||
- ecosystem: composer
|
||||
@@ -757,6 +814,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; GitHub React Advisories and OSV React remain active replacements.
|
||||
replacement_sources: [GitHub React Advisories, OSV React]
|
||||
- name: OSV React
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -795,6 +855,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; GitHub Next.js Advisories and OSV Next.js remain active replacements.
|
||||
replacement_sources: [GitHub Next.js Advisories, OSV Next.js]
|
||||
- name: OSV Next.js
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -831,6 +894,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Vue Security and OSV Vue remain active replacements.
|
||||
replacement_sources: [Vue Security, OSV Vue]
|
||||
- name: OSV Vue
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -869,6 +935,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Nuxt Security and OSV Nuxt remain active replacements.
|
||||
replacement_sources: [Nuxt Security, OSV Nuxt]
|
||||
- name: OSV Nuxt
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -905,6 +974,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Vite Security and OSV Vite remain active replacements.
|
||||
replacement_sources: [Vite Security, OSV Vite]
|
||||
- name: OSV Vite
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -934,6 +1006,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Angular remains the active replacement source.
|
||||
replacement_sources: [OSV Angular]
|
||||
- name: OSV Angular
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -965,6 +1040,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV SvelteKit remains the active replacement source.
|
||||
replacement_sources: [OSV SvelteKit]
|
||||
- name: OSV SvelteKit
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -994,6 +1072,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Astro remains the active replacement source.
|
||||
replacement_sources: [OSV Astro]
|
||||
- name: OSV Astro
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1023,6 +1104,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Express remains the active replacement source.
|
||||
replacement_sources: [OSV Express]
|
||||
- name: OSV Express
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1052,6 +1136,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV NestJS remains the active replacement source.
|
||||
replacement_sources: [OSV NestJS]
|
||||
- name: OSV NestJS
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1081,6 +1168,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Koa remains the active replacement source.
|
||||
replacement_sources: [OSV Koa]
|
||||
- name: OSV Koa
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1110,6 +1200,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Fastify remains the active replacement source.
|
||||
replacement_sources: [OSV Fastify]
|
||||
- name: OSV Fastify
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1139,6 +1232,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Hapi remains the active replacement source.
|
||||
replacement_sources: [OSV Hapi]
|
||||
- name: OSV Hapi
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1198,6 +1294,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV Undici remains the active replacement source.
|
||||
replacement_sources: [OSV Undici]
|
||||
- name: OSV Undici
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1227,6 +1326,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV webpack remains the active replacement source.
|
||||
replacement_sources: [OSV webpack]
|
||||
- name: OSV webpack
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1256,6 +1358,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; OSV esbuild remains the active replacement source.
|
||||
replacement_sources: [OSV esbuild]
|
||||
- name: OSV esbuild
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1292,6 +1397,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Spring Security Advisories remains the active replacement source.
|
||||
replacement_sources: [Spring Security Advisories]
|
||||
ecosystem_sources: []
|
||||
research_sources: []
|
||||
package_names:
|
||||
@@ -1326,6 +1434,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GitHub advisory API is quota-limited; Spring official security page remains the active source.
|
||||
replacement_sources: [Spring Security Advisories]
|
||||
ecosystem_sources: []
|
||||
research_sources: []
|
||||
package_names:
|
||||
@@ -1358,6 +1469,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GitHub advisory API is quota-limited; Spring official security page remains the active source.
|
||||
replacement_sources: [Spring Security Advisories]
|
||||
ecosystem_sources: []
|
||||
research_sources: []
|
||||
package_names:
|
||||
@@ -1383,6 +1497,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GitHub advisory API is quota-limited; OSV Laravel remains the active machine-readable source.
|
||||
replacement_sources: [OSV Laravel]
|
||||
- name: OSV Laravel
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1412,6 +1529,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GitHub advisory API is quota-limited; OSV Symfony remains the active machine-readable source.
|
||||
replacement_sources: [OSV Symfony]
|
||||
- name: OSV Symfony
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1444,6 +1564,29 @@ systems:
|
||||
advisory_mode: core
|
||||
keywords: [django]
|
||||
max_items: 60
|
||||
status: retired
|
||||
retired_reason: Official security tag feed became unstable; use official weblog index and release archive instead.
|
||||
replacement_sources: [Django Security Weblog, Django Security Releases Archive]
|
||||
- name: Django Security Weblog
|
||||
kind: vendor-index
|
||||
url: https://www.djangoproject.com/weblog/
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
keywords: [django, security, release]
|
||||
max_items: 60
|
||||
parser_hints:
|
||||
keywords: [django, security, release]
|
||||
include_url_patterns: [/weblog/]
|
||||
- name: Django Security Releases Archive
|
||||
kind: vendor-index
|
||||
url: https://docs.djangoproject.com/en/dev/releases/security/
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
keywords: [django, security]
|
||||
max_items: 40
|
||||
parser_hints:
|
||||
keywords: [django, security]
|
||||
include_url_patterns: [/releases/security/]
|
||||
- name: OSV Django
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1477,6 +1620,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GitHub advisory API is quota-limited; OSV Flask remains the active machine-readable source.
|
||||
replacement_sources: [OSV Flask]
|
||||
ecosystem_sources: []
|
||||
research_sources: []
|
||||
package_names:
|
||||
@@ -1506,6 +1652,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GitHub advisory API is quota-limited; OSV Werkzeug remains the active machine-readable source.
|
||||
replacement_sources: [OSV Werkzeug]
|
||||
ecosystem_sources: []
|
||||
research_sources: []
|
||||
package_names:
|
||||
@@ -1531,6 +1680,9 @@ systems:
|
||||
name: GitHub Global Advisories
|
||||
confidence: official
|
||||
advisory_mode: core
|
||||
status: retired
|
||||
retired_reason: Unauthenticated GitHub advisory API is quota-limited; OSV Rails remains the active machine-readable source.
|
||||
replacement_sources: [OSV Rails]
|
||||
- name: OSV Rails
|
||||
kind: osv-batch
|
||||
confidence: official
|
||||
@@ -1798,6 +1950,16 @@ systems:
|
||||
advisory_mode: server
|
||||
keywords: [haproxy, security]
|
||||
max_items: 50
|
||||
status: retired
|
||||
retired_reason: Legacy haproxy.org security page no longer yields stable scrape results for monitoring.
|
||||
replacement_sources: [HAProxy Blog Feed]
|
||||
- name: HAProxy Blog Feed
|
||||
kind: rss-feed
|
||||
url: https://www.haproxy.com/feed/
|
||||
confidence: official
|
||||
advisory_mode: server
|
||||
keywords: [haproxy, security, cve]
|
||||
max_items: 40
|
||||
- name: NVD HAProxy
|
||||
kind: nvd-search
|
||||
keyword: HAProxy
|
||||
@@ -2041,6 +2203,9 @@ systems:
|
||||
advisory_mode: core
|
||||
keywords: [mattermost]
|
||||
max_items: 50
|
||||
status: retired
|
||||
retired_reason: Mattermost security updates page returned repeated 403 responses from the collector path; NVD replacement remains active.
|
||||
replacement_sources: [NVD Mattermost]
|
||||
- name: NVD Mattermost
|
||||
kind: nvd-search
|
||||
keyword: Mattermost
|
||||
|
||||
@@ -88,18 +88,20 @@
|
||||
<div class="meta">工作台内置镜像页：89 条 advisory 最新完整度、family 矩阵与 ingest 健康度。</div>
|
||||
<pre># 全库 Advisory 完整度报告
|
||||
|
||||
- 生成时间: `2026-03-18T14:45:55+00:00`
|
||||
- 最新 advisory 完整度: `0/5` `verified-real`
|
||||
- 生成时间: `2026-03-18T17:52:49+00:00`
|
||||
- 最新 advisory 完整度: `0/0` `verified-real`
|
||||
- 合成验证数量: `0`
|
||||
- 阻塞数量: `0`
|
||||
- 人工/待补证据数量: `5`
|
||||
- 人工/待补证据数量: `0`
|
||||
- 完整度百分比: `0.0%`
|
||||
- active source 全绿: `110/110`
|
||||
- source open alerts: `0`
|
||||
- 最近一次 source 全绿: `2026-03-18T17:44:31+00:00`
|
||||
|
||||
## 系统覆盖矩阵
|
||||
|
||||
| 系统 | 总数 | verified-real | verified-synthetic | blocked | manual | family 覆盖 |
|
||||
| --- | ---: | ---: | ---: | ---: | ---: | --- |
|
||||
| nextjs | 5 | 0 | 0 | 0 | 5 | proxy-boundary(0/4), request-smuggling(0/1) |
|
||||
|
||||
## 历史阻塞项修复纪要
|
||||
|
||||
@@ -107,39 +109,14 @@
|
||||
- Family profiles previously used note-only attack runners and dry-run placeholders.
|
||||
- Baseline and browser steps were skipped when environment readiness was not enforced.
|
||||
- Latest completeness now uses one advisory -> latest run semantics instead of historical run piles.
|
||||
- Source health now counts only status=active sources; retired sources are audited separately with replacement links.
|
||||
|
||||
## Ingest / Source 健康度
|
||||
|
||||
- source failures: `29`
|
||||
- drupal::Drupal Security Advisories Site::HTTPError
|
||||
- discourse::Discourse Meta Security::HTTPError
|
||||
- adobe-commerce::Adobe Security Bulletins::ConnectionError
|
||||
- react::GitHub Global Advisories::TypeError
|
||||
- nextjs::GitHub Global Advisories::AttributeError
|
||||
- vue::GitHub Global Advisories::HTTPError
|
||||
- nuxt::GitHub Global Advisories::HTTPError
|
||||
- vite::GitHub Global Advisories::HTTPError
|
||||
- angular::GitHub Global Advisories::HTTPError
|
||||
- sveltekit::GitHub Global Advisories::HTTPError
|
||||
- astro::GitHub Global Advisories::HTTPError
|
||||
- express::GitHub Global Advisories::HTTPError
|
||||
- nestjs::GitHub Global Advisories::HTTPError
|
||||
- koa::GitHub Global Advisories::HTTPError
|
||||
- fastify::GitHub Global Advisories::HTTPError
|
||||
- hapi::GitHub Global Advisories::HTTPError
|
||||
- undici::GitHub Global Advisories::HTTPError
|
||||
- webpack::GitHub Global Advisories::HTTPError
|
||||
- esbuild::GitHub Global Advisories::HTTPError
|
||||
- spring-framework::GitHub Global Advisories::HTTPError
|
||||
- spring-security::GitHub Global Advisories::HTTPError
|
||||
- spring-boot::GitHub Global Advisories::HTTPError
|
||||
- laravel::GitHub Global Advisories::HTTPError
|
||||
- symfony::GitHub Global Advisories::HTTPError
|
||||
- django::Django Security RSS::HTTPError
|
||||
- flask::GitHub Global Advisories::HTTPError
|
||||
- werkzeug::GitHub Global Advisories::HTTPError
|
||||
- rails::GitHub Global Advisories::HTTPError
|
||||
- haproxy::HAProxy Security Advisories::HTTPError
|
||||
- source failures: `0`
|
||||
- active sources: `110`
|
||||
- green sources: `110`
|
||||
- open alerts: `0`
|
||||
|
||||
## 剩余风险说明
|
||||
|
||||
|
||||
在新工单中引用
屏蔽一个用户