chore(deps): bump the npm_and_yarn group across 1 directory with 1 update

Bumps the npm_and_yarn group with 1 update in the / directory: [picomatch](https://github.com/micromatch/picomatch). Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4) --- updated-dependencies: - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
fix(deps): remove ajv override to fix electron-builder compatibility
2026-03-27 15:07:55 +00:00 · 2026-03-27 13:10:48 +00:00 · 2026-03-27 21:09:28 +08:00 · 2026-03-27 21:04:44 +08:00 · 2026-03-27 20:58:14 +08:00 · 2026-03-27 19:12:31 +08:00
9 changed files with 240 additions and 32 deletions
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,6 +49,22 @@ jobs:
        run: |
          npx electron-builder --mac dmg --arm64 --publish always

+      - name: Inject minimumVersion into latest yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          TAG=${GITHUB_REF_NAME}
+          REPO=${{ github.repository }}
+          MINIMUM_VERSION="4.1.7"
+          for YML_FILE in latest-mac.yml latest-arm64-mac.yml; do
+            gh release download "$TAG" --repo "$REPO" --pattern "$YML_FILE" --output "/tmp/$YML_FILE" 2>/dev/null || continue
+            if ! grep -q 'minimumVersion' "/tmp/$YML_FILE"; then
+              echo "minimumVersion: $MINIMUM_VERSION" >> "/tmp/$YML_FILE"
+            fi
+            gh release upload "$TAG" --repo "$REPO" "/tmp/$YML_FILE" --clobber
+          done
+
  release-linux:
    runs-on: ubuntu-latest

@@ -85,6 +101,20 @@ jobs:
        run: |
          npx electron-builder --linux --publish always

+      - name: Inject minimumVersion into latest yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          TAG=${GITHUB_REF_NAME}
+          REPO=${{ github.repository }}
+          MINIMUM_VERSION="4.1.7"
+          gh release download "$TAG" --repo "$REPO" --pattern "latest-linux.yml" --output "/tmp/latest-linux.yml" 2>/dev/null
+          if [ -f /tmp/latest-linux.yml ] && ! grep -q 'minimumVersion' /tmp/latest-linux.yml; then
+            echo "minimumVersion: $MINIMUM_VERSION" >> /tmp/latest-linux.yml
+            gh release upload "$TAG" --repo "$REPO" /tmp/latest-linux.yml --clobber
+          fi
+
  release:
    runs-on: windows-latest

@@ -121,6 +151,20 @@ jobs:
        run: |
          npx electron-builder --win nsis --x64 --publish always '--config.artifactName=${productName}-${version}-x64-Setup.${ext}'

+      - name: Inject minimumVersion into latest yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          TAG=${GITHUB_REF_NAME}
+          REPO=${{ github.repository }}
+          MINIMUM_VERSION="4.1.7"
+          gh release download "$TAG" --repo "$REPO" --pattern "latest.yml" --output "/tmp/latest.yml" 2>/dev/null
+          if [ -f /tmp/latest.yml ] && ! grep -q 'minimumVersion' /tmp/latest.yml; then
+            echo "minimumVersion: $MINIMUM_VERSION" >> /tmp/latest.yml
+            gh release upload "$TAG" --repo "$REPO" /tmp/latest.yml --clobber
+          fi
+
  release-windows-arm64:
    runs-on: windows-latest

@@ -157,6 +201,20 @@ jobs:
        run: |
          npx electron-builder --win nsis --arm64 --publish always '--config.publish.channel=latest-arm64' '--config.artifactName=${productName}-${version}-arm64-Setup.${ext}'

+      - name: Inject minimumVersion into latest yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          TAG=${GITHUB_REF_NAME}
+          REPO=${{ github.repository }}
+          MINIMUM_VERSION="4.1.7"
+          gh release download "$TAG" --repo "$REPO" --pattern "latest-arm64.yml" --output "/tmp/latest-arm64.yml" 2>/dev/null
+          if [ -f /tmp/latest-arm64.yml ] && ! grep -q 'minimumVersion' /tmp/latest-arm64.yml; then
+            echo "minimumVersion: $MINIMUM_VERSION" >> /tmp/latest-arm64.yml
+            gh release upload "$TAG" --repo "$REPO" /tmp/latest-arm64.yml --clobber
+          fi
+
  update-release-notes:
    runs-on: ubuntu-latest
    needs:
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -0,0 +1,95 @@
+name: Security Scan
+
+on:
+  schedule:
+    - cron: '0 2 * * *'  # 每天 UTC 02:00（北京时间 10:00）
+  workflow_dispatch:     # 支持手动触发
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  security-scan:
+    name: Security Scan (${{ matrix.branch }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        branch:
+          - main
+
+    steps:
+      - name: Checkout ${{ matrix.branch }}
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      # 1. npm audit - 检查依赖漏洞
+      - name: Dependency vulnerability audit
+        run: pnpm audit --audit-level=moderate
+        continue-on-error: true
+
+      # 2. CodeQL 静态分析
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript, typescript
+          queries: security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:javascript-typescript/branch:${{ matrix.branch }}'
+
+      # 3. 密钥/敏感信息扫描
+      - name: Secret scanning with Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        continue-on-error: true
+
+  # 动态获取所有分支并扫描（排除已在 matrix 中的）
+  scan-all-branches:
+    name: Scan additional branches
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: List all branches
+        id: branches
+        run: |
+          git branch -r | grep -v HEAD | sed 's|origin/||' | tr -d ' ' | while read branch; do
+            echo "Branch: $branch"
+          done
+
+      - name: Run pnpm audit on all branches
+        run: |
+          git branch -r | grep -v HEAD | sed 's|origin/||' | tr -d ' ' | while read branch; do
+            echo "===== Auditing branch: $branch ====="
+            git checkout "$branch" 2>/dev/null || continue
+            pnpm install --frozen-lockfile --silent 2>/dev/null || npm install --silent 2>/dev/null || true
+            pnpm audit --audit-level=moderate 2>/dev/null || true
+          done
+        continue-on-error: true
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -0,0 +1,23 @@
+title = "Gitleaks Config"
+
+[extend]
+# 继承默认规则
+useDefault = true
+
+# 排除误报路径
+[[rules]]
+id = "curl-auth-header"
+[rules.allowlist]
+paths = [
+  '''docs/HTTP-API\.md'''
+]
+regexes = [
+  '''YOUR_TOKEN'''
+]
+
+[[rules]]
+id = "generic-api-key"
+[rules.allowlist]
+paths = [
+  '''src/pages/ChatPage\.tsx'''
+]
--- a/electron/main.ts
+++ b/electron/main.ts
@@ -1200,7 +1200,8 @@ function registerIpcHandlers() {
          return {
            hasUpdate: true,
            version: latestVersion,
-            releaseNotes: normalizeReleaseNotes(result.updateInfo.releaseNotes)
+            releaseNotes: normalizeReleaseNotes(result.updateInfo.releaseNotes),
+            minimumVersion: (result.updateInfo as any).minimumVersion
          }
        }
      }
@@ -2661,7 +2662,8 @@ function checkForUpdatesOnStartup() {
          // 通知渲染进程有新版本
          mainWindow.webContents.send('app:updateAvailable', {
            version: latestVersion,
-            releaseNotes: normalizeReleaseNotes(result.updateInfo.releaseNotes)
+            releaseNotes: normalizeReleaseNotes(result.updateInfo.releaseNotes),
+            minimumVersion: (result.updateInfo as any).minimumVersion
          })
        }
      }
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "weflow",
-  "version": "2.1.0",
+  "version": "4.3.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "weflow",
-      "version": "2.1.0",
+      "version": "4.3.0",
      "hasInstallScript": true,
      "dependencies": {
        "echarts": "^5.5.1",
@@ -24,7 +24,7 @@
        "react": "^19.2.3",
        "react-dom": "^19.2.3",
        "react-markdown": "^10.1.0",
-        "react-router-dom": "^7.1.1",
+        "react-router-dom": "^7.13.2",
        "react-virtuoso": "^4.18.1",
        "remark-gfm": "^4.0.1",
        "sherpa-onnx-node": "^1.10.38",
@@ -8867,9 +8867,9 @@
      "license": "ISC"
    },
    "node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmmirror.com/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmmirror.com/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
      "dev": true,
      "license": "MIT",
      "optional": true,
@@ -9073,9 +9073,9 @@
      }
    },
    "node_modules/react-router": {
-      "version": "7.11.0",
-      "resolved": "https://registry.npmmirror.com/react-router/-/react-router-7.11.0.tgz",
-      "integrity": "sha512-uI4JkMmjbWCZc01WVP2cH7ZfSzH91JAZUDd7/nIprDgWxBV1TkkmLToFh7EbMTcMak8URFRa2YoBL/W8GWnCTQ==",
+      "version": "7.13.2",
+      "resolved": "https://registry.npmmirror.com/react-router/-/react-router-7.13.2.tgz",
+      "integrity": "sha512-tX1Aee+ArlKQP+NIUd7SE6Li+CiGKwQtbS+FfRxPX6Pe4vHOo6nr9d++u5cwg+Z8K/x8tP+7qLmujDtfrAoUJA==",
      "license": "MIT",
      "dependencies": {
        "cookie": "^1.0.1",
@@ -9095,12 +9095,12 @@
      }
    },
    "node_modules/react-router-dom": {
-      "version": "7.11.0",
-      "resolved": "https://registry.npmmirror.com/react-router-dom/-/react-router-dom-7.11.0.tgz",
-      "integrity": "sha512-e49Ir/kMGRzFOOrYQBdoitq3ULigw4lKbAyKusnvtDu2t4dBX4AGYPrzNvorXmVuOyeakai6FUPW5MmibvVG8g==",
+      "version": "7.13.2",
+      "resolved": "https://registry.npmmirror.com/react-router-dom/-/react-router-dom-7.13.2.tgz",
+      "integrity": "sha512-aR7SUORwTqAW0JDeiWF07e9SBE9qGpByR9I8kJT5h/FrBKxPMS6TiC7rmVO+gC0q52Bx7JnjWe8Z1sR9faN4YA==",
      "license": "MIT",
      "dependencies": {
-        "react-router": "7.11.0"
+        "react-router": "7.13.2"
      },
      "engines": {
        "node": ">=20.0.0"
@@ -10236,9 +10236,9 @@
      }
    },
    "node_modules/tinyglobby/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmmirror.com/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmmirror.com/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -10786,9 +10786,9 @@
      }
    },
    "node_modules/vite/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmmirror.com/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmmirror.com/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
      "dev": true,
      "license": "MIT",
      "engines": {
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "weflow",
-  "version": "2.1.0",
+  "version": "4.3.0",
  "description": "WeFlow",
  "main": "dist-electron/main.js",
  "author": {
@@ -38,7 +38,7 @@
    "react": "^19.2.3",
    "react-dom": "^19.2.3",
    "react-markdown": "^10.1.0",
-    "react-router-dom": "^7.1.1",
+    "react-router-dom": "^7.13.2",
    "react-virtuoso": "^4.18.1",
    "remark-gfm": "^4.0.1",
    "sherpa-onnx-node": "^1.10.38",
@@ -61,6 +61,17 @@
    "vite-plugin-electron": "^0.28.8",
    "vite-plugin-electron-renderer": "^0.14.6"
  },
+  "pnpm": {
+    "overrides": {
+      "tar": ">=6.2.1",
+      "minimatch": ">=3.1.2",
+      "rollup": ">=4.0.0",
+      "immutable": ">=4.0.0",
+      "lodash": ">=4.17.21",
+      "brace-expansion": ">=1.1.11",
+      "picomatch": ">=2.3.2"
+    }
+  },
  "build": {
    "appId": "com.WeFlow.app",
    "publish": {
@@ -178,4 +189,4 @@
    ],
    "icon": "resources/icon.icns"
  }
-}
+}
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -312,10 +312,14 @@ function App() {
    const removeUpdateListener = window.electronAPI?.app?.onUpdateAvailable?.((info: any) => {
      // 发现新版本时保存更新信息，锁定状态下不弹窗，解锁后再显示
      if (info) {
-        setUpdateInfo({ ...info, hasUpdate: true })
-        if (!useAppStore.getState().isLocked) {
-          setShowUpdateDialog(true)
-        }
+        window.electronAPI.app.getVersion().then((currentVersion: string) => {
+          const isMandatory = !!(info.minimumVersion && currentVersion &&
+            currentVersion.localeCompare(info.minimumVersion, undefined, { numeric: true, sensitivity: 'base' }) <= 0)
+          setUpdateInfo({ ...info, hasUpdate: true, isMandatory })
+          if (!useAppStore.getState().isLocked) {
+            setShowUpdateDialog(true)
+          }
+        })
      }
    })
    const removeProgressListener = window.electronAPI?.app?.onDownloadProgress?.((progress: any) => {
@@ -685,10 +689,11 @@ function App() {
      <UpdateDialog
        open={showUpdateDialog}
        updateInfo={updateInfo}
-        onClose={() => setShowUpdateDialog(false)}
+        onClose={() => { if (!(updateInfo as any)?.isMandatory) setShowUpdateDialog(false) }}
        onUpdate={handleUpdateNow}
        onIgnore={handleIgnoreUpdate}
        isDownloading={isDownloading}
+        isMandatory={!!(updateInfo as any)?.isMandatory}
        progress={downloadProgress}
      />

--- a/src/components/UpdateDialog.scss
+++ b/src/components/UpdateDialog.scss
@@ -282,4 +282,13 @@
        transform: translateY(0);
        opacity: 1;
    }
-}
+}
+.mandatory-tip {
+    color: #e53e3e;
+    font-size: 13px;
+    text-align: center;
+    margin: 0 0 8px;
+    padding: 6px 12px;
+    background: rgba(229, 62, 62, 0.08);
+    border-radius: 6px;
+}
--- a/src/components/UpdateDialog.tsx
+++ b/src/components/UpdateDialog.tsx
@@ -14,6 +14,7 @@ interface UpdateDialogProps {
    onUpdate: () => void
    onIgnore?: () => void
    isDownloading: boolean
+    isMandatory?: boolean
    progress: number | {
        percent: number
        bytesPerSecond?: number
@@ -30,6 +31,7 @@ const UpdateDialog: React.FC<UpdateDialogProps> = ({
    onUpdate,
    onIgnore,
    isDownloading,
+    isMandatory,
    progress
 }) => {
    if (!open || !updateInfo) return null
@@ -69,7 +71,7 @@ const UpdateDialog: React.FC<UpdateDialogProps> = ({
    return (
        <div className="update-dialog-overlay">
            <div className="update-dialog">
-                {!isDownloading && (
+                {!isDownloading && !isMandatory && (
                    <button className="close-btn" onClick={onClose}>
                        <X size={20} />
                    </button>
@@ -119,11 +121,14 @@ const UpdateDialog: React.FC<UpdateDialogProps> = ({
                        </div>
                    ) : (
                        <div className="actions">
-                            {onIgnore && (
+                            {onIgnore && !isMandatory && (
                                <button className="btn-ignore" onClick={onIgnore}>
                                    忽略本次更新
                                </button>
                            )}
+                            {isMandatory && (
+                                <p className="mandatory-tip">此版本存在安全风险，必须更新后才能继续使用</p>
+                            )}
                            <button className="btn-update" onClick={onUpdate}>
                                开启新旅程
                            </button>
Author	SHA1	Message	Date
dependabot[bot]	876c5d0fea	chore(deps): bump the npm_and_yarn group across 1 directory with 1 update Bumps the npm_and_yarn group with 1 update in the / directory: [picomatch](https://github.com/micromatch/picomatch). Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4) --- updated-dependencies: - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-27 13:10:48 +00:00
hicccc77	39634a690c	fix(deps): remove ajv override to fix electron-builder compatibility	2026-03-27 21:09:28 +08:00
hicccc77	a7001eb6da	fix(deps): upgrade react-router-dom to 7.13.2 and add pnpm overrides for security vulnerabilities - Upgrade react-router-dom ^7.1.1 -> ^7.13.2 - Add pnpm.overrides to force safe versions of: tar, minimatch, rollup, immutable, lodash, ajv, brace-expansion, picomatch	2026-03-27 21:04:44 +08:00
hicccc77	71e3540f18	ci: add gitleaks config to suppress false positives	2026-03-27 20:58:14 +08:00
hicccc77	78cadfd352	ci: add security-events write permission for CodeQL	2026-03-27 19:12:31 +08:00
hicccc77	b3758d2baf	ci: fix pnpm install frozen-lockfile issue	2026-03-27 18:17:14 +08:00
hicccc77	bc794e9a44	ci: add daily security scan workflow for all branches	2026-03-27 17:59:09 +08:00
xuncha	6277576249	Merge pull request #560 from JiQingzhe2004/main feat: 强制更新支持 minimumVersion，阻止低版本用户继续使用	2026-03-27 15:23:02 +08:00
JiQingzhe2004	2201d369fa	chore: bump version to 4.3.0	2026-03-27 14:43:33 +08:00
JiQingzhe2004	9f4e4790f5	feat: 强制更新支持 minimumVersion，阻止低版本用户继续使用	2026-03-27 14:43:08 +08:00
xuncha	501e373e38	Merge pull request #559 from xunchahaha/main 更新打包	2026-03-27 13:10:50 +08:00