Stabilize dependency maintenance and CI

.github/dependabot.yml

@@ -5,15 +5,33 @@ updates:
     schedule:
       interval: monthly
     open-pull-requests-limit: 5
+    groups:
+      python-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: npm
     directory: /src/web/frontend_v2
     schedule:
       interval: monthly
     open-pull-requests-limit: 5
+    groups:
+      frontend-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
     open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -13,12 +13,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -48,10 +48,10 @@ jobs:
         working-directory: src/web/frontend_v2
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
@@ -68,11 +68,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out full history
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Scan Git history
-        uses: gitleaks/gitleaks-action@v2
+        uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -20,6 +20,11 @@ All notable changes are documented here. 本文件记录值得关注的行为、
 
 ### Fixed / 修复
 
+- Upgrade GitHub Actions to their current Node.js runtimes and remove the CI deprecation warnings.
+- Replace password examples that triggered false-positive secret findings while keeping the examples fail-closed.
+- Group routine Dependabot updates to reduce branch and pull-request noise.
+- Refresh supported backend and frontend dependencies, including Vue, Pinia, Tailwind CSS, NoneBot2, Uvicorn, and ujson.
+- Migrate the NoneBot CLI project metadata to its current grouped configuration format.
 - Redesign both README landing sections with the project logo, focused badges, a real dashboard screenshot, and readable navigation.
 - Remove obsolete slogan and organization-specific positioning from project documentation.
 - Report only the 588 deduplicated keyword entries in bundled-content summaries.

README.en.md

@@ -153,7 +153,7 @@ Copy-Item .env.prod.example .env.prod
 Set at least a strong dashboard password in `.env.prod`:
 
 ```dotenv
-WEB_ADMIN_PASSWORD=replace-with-at-least-12-characters
+WEB_ADMIN_PASSWORD=CHANGE_ME_USE_AT_LEAST_12_CHARACTERS
 ```
 
 The template pins the ORM database to `data/data.db`; keep `SQLALCHEMY_DATABASE_URL` configured.

README.md

@@ -159,7 +159,7 @@ cp .env.prod.example .env.prod
 至少修改 `.env.prod` 中的：
 
 ```dotenv
-WEB_ADMIN_PASSWORD=请设置至少12位的强密码
+WEB_ADMIN_PASSWORD=CHANGE_ME_USE_AT_LEAST_12_CHARACTERS
 ```
 
 模板已经把 ORM 数据库固定为 `data/data.db`，请不要删除 `SQLALCHEMY_DATABASE_URL`。

docs/en/installation.md

@@ -48,7 +48,7 @@ Copy-Item .env.prod.example .env.prod
 Set a strong dashboard password:
 
 ```dotenv
-WEB_ADMIN_PASSWORD=replace-with-at-least-12-characters
+WEB_ADMIN_PASSWORD=CHANGE_ME_USE_AT_LEAST_12_CHARACTERS
 ```
 
 Keep the dashboard on loopback by default:

docs/安装部署.md

@@ -61,7 +61,7 @@ cp .env.prod.example .env.prod
 必须设置一个至少 12 位、不是常见默认值的后台密码：
 
 ```dotenv
-WEB_ADMIN_PASSWORD=replace-with-a-strong-password
+WEB_ADMIN_PASSWORD=CHANGE_ME_USE_AT_LEAST_12_CHARACTERS
 ```
 
 建议保持 Web 后台只监听本机：

docs/配置参考.md

@@ -31,7 +31,7 @@ AntiFraudBot 使用 NoneBot2 的环境配置机制。`.env` 选择运行环境
 ```dotenv
 WEB_HOST=127.0.0.1
 WEB_PORT=8000
-WEB_ADMIN_PASSWORD=a-long-random-password
+WEB_ADMIN_PASSWORD=CHANGE_ME_USE_AT_LEAST_12_CHARACTERS
 WEB_CORS_ORIGINS=["https://antifraud.example.com"]
 JWT_EXPIRE_MINUTES=120
 ```

pyproject.toml

@@ -25,13 +25,19 @@ dependencies = [
 package-mode = false
 
 [tool.nonebot]
-adapters = [
-    { name = "OneBot V11", module_name = "nonebot.adapters.onebot.v11" }
-]
-plugins = ["nonebot_plugin_apscheduler"]
 plugin_dirs = ["src/plugins"]
 builtin_plugins = []
 
+[tool.nonebot.adapters]
+nonebot-adapter-onebot = [
+    { name = "OneBot V11", module_name = "nonebot.adapters.onebot.v11" }
+]
+"@local" = []
+
+[tool.nonebot.plugins]
+nonebot-plugin-apscheduler = ["nonebot_plugin_apscheduler"]
+"@local" = []
+
 [tool.poetry.group.dev.dependencies]
 pytest = ">=8.0.0"
 ruff = ">=0.12.0"