What the data for this category looks like
This category of data includes two types: structured and semi-structured. Data sources include package managers, code repositories, vulnerability databases, and license databases. Daily documents include SBOM lists, dependency risk reports, license lists, and repair tickets. Fields include dependency package names, version numbers, vulnerability CVE IDs, license types, risk levels, repair status, and more. The data is updated daily or when each version is released, to support real-time monitoring needs for supply chain security and open source dependency governance.
What constraints do these characteristics impose on the re-ranking and hybrid retrieval link
First, the data includes both structured package names and version numbers, plus semi-structured vulnerability descriptions and risk reports. Hybrid retrieval must support both exact keyword matching and semantic matching, balancing exact recall of package names and semantic association of vulnerability risks. Second, the data update frequency is high. The re-ranking link must prioritize recalling the latest vulnerability association results to avoid displaying outdated risk information. Third, documents include a risk level field. Re-ranking weights should prioritize high-risk and medium-risk entries, to meet the need of quickly locating high-priority issues in operations on-duty scenarios. Fourth, most queries in the operation ticket scenario revolve around repair solutions and dependency version adjustments. The sorting of retrieval results must match this intent to avoid interference from irrelevant content.
How to set the configuration
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
usingReRank | Enabled | This category of data includes a risk level field. Enabling re-ranking prioritizes sorting results related to high-risk dependencies, adapting to rapid positioning needs in operations on-duty scenarios |
searchMode | Hybrid retrieval mode | The data includes both structured package names and semi-structured vulnerability descriptions. Hybrid retrieval balances exact matching of package names and semantic matching of vulnerability risks |
similarity | 0.75–0.85 | Filters irrelevant dependency entries with low similarity, adapting to precise matching needs in dependency governance scenarios |
limit | Top 10 entries | Operations on-duty scenarios require quick browsing of results. Limiting the number of returned entries avoids information overload |
Three common mistakes
- Phenomenon: The reranker interface returns false, and the docker-deployed reranker service can be connected normally. Cause: The call port of the re-ranking service is not correctly bound in the FastGPT configuration, or the effective switch for
usingReRankis not enabled. - Phenomenon: Hybrid retrieval results do not prioritize displaying high-risk dependency entries. Cause: The risk level field is not included in the weight calculation of re-ranking, or the field weighted configuration of the hybrid retrieval mode is not enabled.
- Phenomenon: The number of retrieved results is much larger than expected. Cause: The
limitparameter is not set correctly, or the return upper limit of the recall stage and the display number of the re-ranking stage are not aligned.
How to confirm the configuration is complete
- Enter the corresponding knowledge base configuration page of FastGPT v4.17.0, confirm that the
usingReRankswitch is enabled. - Initiate a test query containing high-risk dependency keywords, check whether the sorting of returned results prioritizes entries with higher risk levels.
- View the retrieval log, confirm that
searchModeis hybrid retrieval mode, and the filtering results of thesimilarityparameter meet expectations. - Test the connectivity of the re-ranking service, confirm that the sorted results returned after the call match the configured weight rules.
The values provided here are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.