(hugegraph-ai) 02/02: docs(code-scan): sync fixed issue statuses

[ji...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

imbajin pushed a commit to branch goal-scan
in repository https://gitbox.apache.org/repos/asf/hugegraph-ai.git

commit 53f3ebac1717e589f57d3cbb979e86e75a8d5b31
Author: imbajin <ji...@apache.org>
AuthorDate: Sun May 31 11:59:32 2026 +0800

    docs(code-scan): sync fixed issue statuses
    
    - correct status rows for completed requested fixes
    - leave unrelated open scan findings marked open
    - keep CS-001, CS-002, CS-004, CS-008, CS-011, CS-012, CS-013, and CS-030 fixed
---
 .workflow/code-scan/reports/issues.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.workflow/code-scan/reports/issues.md b/.workflow/code-scan/reports/issues.md
index 665de54d..6c8277f5 100644
--- a/.workflow/code-scan/reports/issues.md
+++ b/.workflow/code-scan/reports/issues.md
@@ -45,7 +45,7 @@ Issue IDs use `CS-NNN`. Priorities are P0 highest through P5 lowest.
 - Module: `hugegraph-python-client`
 - Layer: transport / routing
 - Paths: `hugegraph-python-client/src/pyhugegraph/utils/huge_requests.py:100`, `hugegraph-python-client/src/pyhugegraph/utils/huge_requests.py:120`, `hugegraph-python-client/src/pyhugegraph/api/auth.py:37`, `hugegraph-python-client/src/pyhugegraph/api/auth.py:84`
-- Status: fixed
+- Status: open
 - Evidence: `HGraphSession.resolve()` passes leading-slash paths to `urljoin`, which replaces the base URL path. A base like `http://host/proxy` plus `/auth/groups` resolves to `http://host/auth/groups`.
 - Impact: HugeGraph behind path-prefix proxies or ingress routes is addressed incorrectly.
 - Recommendation: Treat route strings as API-root-relative paths inside the client, or reject base URLs with path prefixes explicitly.
@@ -69,7 +69,7 @@ Issue IDs use `CS-NNN`. Priorities are P0 highest through P5 lowest.
 - Module: `hugegraph-python-client`
 - Layer: transport / routing
 - Paths: `hugegraph-python-client/src/pyhugegraph/utils/huge_config.py:44`, `hugegraph-python-client/src/pyhugegraph/utils/huge_config.py:73`, `hugegraph-python-client/src/pyhugegraph/utils/huge_router.py:139`
-- Status: fixed
+- Status: open
 - Evidence: `HGraphConfig.__post_init__()` probes `/versions` with a fixed `0.5s` timeout. Most probe failures silently set `gs_supported=False`, making graphspace auth routes fail locally with `ValueError`.
 - Impact: HugeGraph 1.7+ auth behavior becomes sensitive to a single transient version probe.
 - Recommendation: Make graphspace configuration explicit or retry/observe the capability probe using the configured timeout.
@@ -81,7 +81,7 @@ Issue IDs use `CS-NNN`. Priorities are P0 highest through P5 lowest.
 - Module: `hugegraph-python-client`
 - Layer: client-api
 - Paths: `hugegraph-python-client/src/pyhugegraph/api/graph.py:68`, `hugegraph-python-client/src/pyhugegraph/api/graph.py:73`, `hugegraph-python-client/src/pyhugegraph/api/graph.py:173`, `hugegraph-python-client/src/pyhugegraph/utils/huge_requests.py:144`
-- Status: fixed
+- Status: open
 - Evidence: `getVertexByPage()`, `getVertexByCondition()`, and `getEdgeByPage()` concatenate labels and JSON properties directly into the URL.
 - Impact: Property values containing `&`, `?`, `#`, `=`, or spaces can corrupt filters and query different data.
 - Recommendation: Use `params=` or `urllib.parse.urlencode()` for all query parameters.
@@ -105,7 +105,7 @@ Issue IDs use `CS-NNN`. Priorities are P0 highest through P5 lowest.
 - Module: `hugegraph-python-client`
 - Layer: gremlin / error contract
 - Paths: `hugegraph-python-client/src/pyhugegraph/api/gremlin.py:48`, `hugegraph-python-client/src/pyhugegraph/api/gremlin.py:54`, `hugegraph-python-client/src/tests/api/test_gremlin.py:99`
-- Status: open
+- Status: fixed
 - Evidence: `GremlinManager.exec()` catches every exception and raises `NotFoundError`.
 - Impact: Auth failures, transport errors, server errors, and syntax errors are indistinguishable upstream.
 - Fix: `GremlinManager.exec()` no longer wraps all lower-level exceptions as `NotFoundError`; typed auth/transport/server/parse exceptions propagate from the transport boundary.
@@ -141,7 +141,7 @@ Issue IDs use `CS-NNN`. Priorities are P0 highest through P5 lowest.
 - Module: `hugegraph-llm`
 - Layer: API / models / config
 - Paths: `hugegraph-llm/src/hugegraph_llm/api/models/rag_requests.py:27`, `hugegraph-llm/src/hugegraph_llm/api/rag_api.py:92`
-- Status: open
+- Status: fixed
 - Evidence: `GraphConfigRequest` has concrete defaults and `set_graph_config()` writes every field to global `huge_settings` whenever `client_config` exists.
 - Impact: A request intended to override one field can clear credentials, graph name, or graphspace for the whole process.
 - Fix: request-scoped graph config updates now use `model_fields_set`, so only explicitly provided nested fields mutate `huge_settings`.
@@ -165,7 +165,7 @@ Issue IDs use `CS-NNN`. Priorities are P0 highest through P5 lowest.
 - Module: `hugegraph-llm`
 - Layer: LLM operator / graph import
 - Paths: `hugegraph-llm/src/hugegraph_llm/operators/llm_op/property_graph_extract.py:53`, `hugegraph-llm/src/hugegraph_llm/operators/hugegraph_op/commit_to_hugegraph.py:134`, `hugegraph-llm/src/hugegraph_llm/flows/import_graph_data.py:65`
-- Status: open
+- Status: fixed
 - Evidence: `filter_item()` converts non-string properties to strings, while `Commit2Graph` enforces schema Python types and skips mismatches. Edge writes can continue and the flow reports success.
 - Impact: KG import can partially fail while the UI reports success.
 - Fix: `filter_item()` no longer stringifies non-string property values, so extracted JSON numeric values survive into `Commit2Graph` schema validation.