What the data for this category looks like
Data for this category mainly comes from package managers, code repositories, vulnerability databases and license databases, with an update frequency of daily or when a version is released. Daily generated documents include SBOM lists, dependency risk reports, license lists and repair tickets. Fields cover component name, version number, vulnerability CVE ID, license type, risk level, repair suggestions and more. The content size of a single document fluctuates with project scale, and core fields use a mixed structured and semi-structured format.
What constraints these characteristics impose on the re-ranking and hybrid retrieval link
Dispersed data sources create differences in document formats and field priorities across different sources. During hybrid retrieval, core fields such as component name and risk level must be aligned first. High update frequency means retrieval data must remain real-time. The re-ranking link must adapt to frequently updated vulnerability and dependency information to avoid displaying expired risk data. Documents contain strongly related fields such as risk level and repair suggestions, so re-ranking weights prioritize high-risk dependencies and emergency repair tickets to meet rapid response requirements in technical support scenarios. Additionally, the time-consuming nature of dependency asset identification and vulnerability matching means the retrieval link cannot add excessive latency, requiring a balance between recall accuracy and response speed.
How to set the configuration
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Filter low-correlation dependency components and vulnerability information to avoid redundant results interfering with technical support scenarios |
limit | Top 10–15 results | Adapt to context length limits for pre-sales Q&A and technical support, while covering core dependencies and high-frequency risk items |
searchMode | hybrid | Combine semantic retrieval and keyword retrieval to match structured fields such as dependency names and vulnerability IDs, as well as unstructured content such as risk descriptions |
usingReRank | Enabled | Reorder recall results by risk level and update time to prioritize high-risk dependencies and emergency repair solutions |
| Reranking threshold | 0.6–0.7 | Filter out still low-correlation results after re-ranking, focusing on high-priority supply chain security issues |
| Single retrieval timeout | 30 seconds | Meet response time requirements for technical support scenarios, avoiding excessive waiting that affects user experience |
This configuration scheme is compatible with FastGPT v4.17.0.
Three common misconfigurations
- Phenomenon: Calls to custom re-ranking channels return a 500 status code or empty results. Cause: Request headers and interface address of the re-ranking service are not configured correctly, causing FastGPT to fail to call third-party re-ranking capabilities normally.
- Phenomenon: Hybrid retrieval results include dependency documents from non-target knowledge bases. Cause: An exclusive supply chain security data source is not bound in the retrieval configuration, or correct component name filtering rules are not set.
- Phenomenon: Semantic retrieval results outperform hybrid retrieval results. Cause: The
similaritythreshold and re-ranking weights are not adjusted for supply chain security scenarios, causing the keyword retrieval part to fail to match core dependency fields and vulnerability IDs.
How to confirm the configuration is correctly set
- Check the number of recall results in the FastGPT retrieval console to confirm that the returned quantity matches the value range of the
limitconfiguration. - Test entering a query containing a high-risk dependency name to check whether the retrieval result prioritizes documents with high risk levels.
- Check the retrieval log to confirm that
searchModeis set to hybrid mode andusingReRankis enabled. - Enter a query containing a vulnerability CVE ID to verify that hybrid retrieval matches both the structured ID field and semantic risk description content.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.