T08 · Insecure Dependencies
Error
- Location
scripts/setup.py:20- Finding
Mandatory setup installs unpinned dependencies from third-party mirrors
- Content
View full analysis
bool: """Install Python dependencies from the configured mirror.""" py = sys.executable print(f"\n[1/3] Python dependency installation (mirror: mirrors.aliyun.com)") print(f" Interpreter: {py}") if not os.path.exists(REQUIREMENTS): print(f" {CROSS} Not found: {REQUIREMENTS}") return False cmd = [ py, "-m", "pip", "install", "-r", REQUIREMENTS, "-q", "-i", PIP_INDEX, "--trusted-host", "mirrors.aliyun.com" ] if _run(cmd, "pip install"): print(f" {CHECK} Dependency installation complete") return True else: print(f" {CROSS} Dependency installation failed; retrying with detailed output:") subprocess.run([ py, "-m", "pip", "install", "-r", REQUIREMENTS, "-i", PIP_INDEX, "--trusted-host", "mirrors.aliyun.com" ]) return False ``` ```python # scripts/setup.py:95-103 def _install_playwright_browser() -> bool: """Install Playwright Chromium from the configured mirror.""" py = sys.executable print(f"\n[2/3] Playwright browser installation (mirror: npmmirror.com)") env = os.environ.copy() env["PLAYWRIGHT_DOWNLOAD_HOST"] = PW_DOWNLOAD_HOST cmd = [py, "-m", "playwright", "install", "chromium"] return _run(cmd, "playwright install chromium", env=env) ``` ```text # scripts/requirements.txt:1-4 feedparser>=6.0 pyyaml>=6.0 markdown>=3.5 playwright>=1.40 ``` ### Technical Analysis The documented first-use work ...[truncated 1757 chars]- Remediation
View remediation