T08 · Insecure Dependencies
Warning
- Location
README.md:36- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and record cryptographic hashes for the approved package and its transitive dependencies: ```text requests== \ --hash=sha256: ``` 3. Install dependencies with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use an isolated virtual environment rather than modifying a shared or system Python installation: ```bash python -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt ``` 5. Add an automated dependency-update process that reviews security advisories and regenerates hashes only after the new versions have been tested and approved. 6. Update both the English and Chinese installation sections so they consistently use the locked dependency manifest. ]]>