feat: implement security scanning and fix JS/TS vulnerabilities

.github/dependabot.yml

@@ -0,0 +1,55 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/src/server/api/go"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "pip"
+    directory: "/src/server/core"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "pip"
+    directory: "/src/client/acontext-py"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "npm"
+    directory: "/src/client/acontext-ts"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "npm"
+    directory: "/src/server/ui"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "docker"
+    directory: "/src/server/api/go"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "docker"
+    directory: "/src/server/core"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "docker"
+    directory: "/src/server/ui"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/workflows/security-scan.yaml

@@ -0,0 +1,83 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - 'src/server/api/go/go.mod'
+      - 'src/server/core/pyproject.toml'
+      - 'src/client/acontext-py/pyproject.toml'
+      - 'src/client/acontext-ts/package.json'
+      - 'src/server/ui/package.json'
+      - '.github/workflows/security-scan.yaml'
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - 'src/server/api/go/go.mod'
+      - 'src/server/core/pyproject.toml'
+      - 'src/client/acontext-py/pyproject.toml'
+      - 'src/client/acontext-ts/package.json'
+      - 'src/server/ui/package.json'
+      - '.github/workflows/security-scan.yaml'
+  workflow_dispatch:
+
+jobs:
+  go-vulncheck:
+    name: Go Vulnerability Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: src/server/api/go/go.mod
+          cache: true
+      - name: Run govulncheck
+        working-directory: src/server/api/go
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+  python-audit:
+    name: Python Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install pip-audit
+        run: pip install pip-audit
+      - name: Audit Projects
+        run: |
+          for dir in src/server/core src/client/acontext-py; do
+            cd $dir
+            uv export --format requirements-txt --no-hashes --no-dev > reqs.txt
+            pip-audit -r reqs.txt
+            rm reqs.txt
+            cd - > /dev/null
+          done
+
+  js-audit:
+    name: JS/TS Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Audit TS SDK
+        working-directory: src/client/acontext-ts
+        run: npm audit --audit-level=high
+      - name: Audit UI
+        working-directory: src/server/ui
+        run: |
+          npm install -g pnpm
+          pnpm audit --audit-level=high

.github/workflows/security-scheduled.yaml

@@ -0,0 +1,67 @@
+name: Security Scheduled Scan
+
+on:
+  schedule:
+    - cron: '0 0 * * 1'
+  workflow_dispatch:
+
+jobs:
+  go-vulncheck:
+    name: Go Vulnerability Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: src/server/api/go/go.mod
+          cache: true
+      - name: Run govulncheck
+        working-directory: src/server/api/go
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+  python-audit:
+    name: Python Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install pip-audit
+        run: pip install pip-audit
+      - name: Audit Projects
+        run: |
+          for dir in src/server/core src/client/acontext-py; do
+            cd $dir
+            uv export --format requirements-txt --no-hashes --no-dev > reqs.txt
+            pip-audit -r reqs.txt
+            rm reqs.txt
+            cd - > /dev/null
+          done
+
+  js-audit:
+    name: JS/TS Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Audit TS SDK
+        working-directory: src/client/acontext-ts
+        run: npm audit --audit-level=high
+      - name: Audit UI
+        working-directory: src/server/ui
+        run: |
+          npm install -g pnpm
+          pnpm audit --audit-level=high

src/client/acontext-py/pyproject.toml

@@ -9,6 +9,7 @@ dependencies = [
     "openai>=2.6.1",
     "anthropic>=0.72.0",
     "pydantic>=2.12.3",
+    "urllib3>=2.6.3",
 ]
 keywords = ["acontext", "sdk", "client", "api"]
 

src/server/api/go/go.mod

@@ -1,6 +1,6 @@
 module github.com/memodb-io/Acontext
 
-go 1.25.3
+go 1.25.5
 
 require (
 	github.com/anthropics/anthropic-sdk-go v1.19.0

src/server/core/pyproject.toml

@@ -29,6 +29,7 @@ dependencies = [
     "opentelemetry-instrumentation-redis>=0.54.0",
     "e2b-code-interpreter>=2.4.1",
     "novita-sandbox>=1.0.4",
+    "urllib3>=2.6.3",
 ]
 
 [dependency-groups]