What this category of data looks like
This category of data primarily originates from package managers, code repositories, vulnerability databases, and license databases. Update frequency is daily or when a new version is released. Daily produced documents include SBOM lists, dependency risk reports, license lists, and repair tickets. Data fields include dependency package name, version number, CVE ID, license type, risk level, repair suggestions, and more. There is no unified fixed output format; formats adjust based on the data source and report type.
What constraints do these characteristics impose on the knowledge base retrieval and recall process
Data sources are scattered and update frequency is high. The retrieval link must support incremental synchronization and versioned matching, to prevent recalling expired dependency risk information. Document structures vary widely across types. Text chunk splitting rules must be adapted for different formats, to ensure core fields such as package name and version number are fully extracted. Strong correlations exist between fields. Retrieval must prioritize matching package name and version combinations, to avoid mixing information from different versions of dependencies. Repair tickets and risk reports have contextual associations. Recall must retain the integrity of associated information, to prevent returning isolated risk entries.
How to set configurations
| Config Item | Recommended Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Filters low-match non-target dependency entries, avoids irrelevant information interfering with retrieval results |
limit | Top 8–12 entries | Adapts to the typical number of dependencies in SBOM lists, controls the total number of results returned per recall |
searchMode | vector + keyword | Combines semantic matching and keyword matching, accurately matches combinations of dependency package names and version numbers |
usingReRank | Enabled | Rearranges initial recall results, prioritizes returning entries most relevant to the current query such as vulnerability ID or license type |
datasetSearchUsingExtensionQuery | Enabled | Expands relevant dependency terms based on user queries, covers package name aliases across different data sources |
collectionIds | Specify the collection ID of the corresponding open source dependency governance knowledge base | Limits retrieval scope, only recalls information from preset compliant data source collections |
Three common mistakes
- Phenomenon: Retrieval results only return 1 matching text block, cannot output multiple associated dependency risk entries. Cause: The
limitparameter is not adjusted to a reasonable range, orusingReRankis not enabled, resulting in overly strict result filtering. - Phenomenon: Knowledge base retrieval cannot be triggered via the specified business channel, or retrieval results cannot be synchronized to the target system. Cause: Interface permissions and callback rules for the corresponding channel are not configured, and extended query adaptation logic is not enabled.
- Phenomenon: Retrieval results mix non-target dependency information, such as data for packages with the same name across different versions. Cause: The keyword matching logic of
searchModeis not enabled, relying only on semantic matching which breaks the association between package name and version number.
How to confirm the configuration is correct
- View knowledge base synchronization logs, confirm that daily or per-version incremental synchronization tasks execute normally with no failed records. This verification is based on the configuration logic of FastGPT v4.17.0.
- Test queries that include dependency package names and version numbers, confirm that returned results include core fields such as risk level, license information, and repair suggestions for the corresponding dependency.
- Adjust the
similarityparameter, verify that low-match irrelevant entries are filtered out, matching the preset threshold range. - Check the
collectionIdsparameter, confirm that it only includes preset knowledge base collections related to open source dependency governance, with no irrelevant data sources included.
The values provided are common starting points and should be measured against local samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.