What data for this category looks like
This category of data primarily comes from package managers, code repositories, public vulnerability databases, and license databases. Daily generated documents include SBOM lists, dependency risk reports, license lists, and repair work orders. Fields cover dependency package names, version numbers, associated vulnerability IDs, license types, risk levels, and repair statuses. Data updates happen daily or alongside software version releases. The asset scope for a single update covers all third-party dependency components of the current project.
Constraints Imposed on Citation Sources and Traceability
Data sources for this category are scattered, and field formats vary widely. The citation traceability link must associate unique identifiers from multi-source data such as package managers and vulnerability databases to prevent cross-source matching errors. Data updates occur frequently, so citation timeliness must align with version updates of dependency components. Delayed citation information will appear otherwise. Daily documents include multiple structured field types. Core fields such as dependency package names and version numbers must be strictly matched during traceability. Otherwise, citations will point to incorrect components. Consequences of errors such as high-risk dependencies going live require the traceability link to have a complete traceable chain. Key verification steps cannot be omitted.
How to Configure Settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Matches the single-entry length of SBOM lists and risk reports to avoid truncating critical dependency information |
responseData | Return only official data source fields | Ensures citations only use valid data from official sources such as package managers and vulnerability databases, reducing redundant content |
detail | Enable full traceability fields | Shows complete information including dependency package versions and vulnerability IDs, meeting traceability requirements for test cases |
| Maximum Context | 16000 characters | Accommodates batch citation content from multiple dependency reports to support test analysis in complex scenarios |
| Single Recall Limit | Top 8 entries | Matches the typical number of associated entries in daily dependency risk reports, preventing excessive irrelevant citations from interfering with analysis |
| Citation Display Format | Hide marker prefixes | Removes redundant citation marker text from outputs, complying with test document output standards |
Three Common Configuration Errors
- Forged citation IDs in output: Generated test cases use citation markers pointing to non-existent data source identifiers. This happens when the system fails to strictly bind dependency components to unique official data source identifiers, resulting in automatically generated invalid citations.
- Uncleaned citation marker text retained: Generated defect analysis documents include formatted text such as "Citation Marker: [1]". This occurs when the citation marker hiding display switch is not configured, or the switch does not function in FastGPT v4.17.0.
- Redundant citation information in repair work orders: Work order content repeatedly references multiple data source entries for the same dependency component. This happens when the single-recall citation limit is not set, leading to overloaded output that impairs readability.
How to Verify Correct Configuration
- Import a local SBOM list under FastGPT v4.17.0, trigger test case generation, and confirm that cited dependency package names and version numbers exactly match the list content.
- Review the generated dependency risk report, and confirm that cited vulnerability information comes from official fields of public vulnerability databases, with no custom or forged identifiers.
- Check output content to confirm no uncleaned citation marker text is present, and only dependency component source descriptions are included.
- Simulate a dependency component version update scenario, and verify that cited data source information updates synchronously with the component version, with no delays.
The values listed above are common starting points and should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.