Lychgate digest — 2026-10-05 (dry-run)

0 would merge · 0 waiting · 8 need you · 0 unanswered issue(s) · 25 observed only

ictechgy/relay-continuity — tier 1, complete, 0 open alerts

• ✋ hold #24 chore(deps): bump github/codeql-action/init from 4.37.6 to 4.38.2 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • CI failing: test (macos-15), Analyze (actions), test (ubuntu-22.04), Analyze (javascript-typescript), Analyze (rust)
  • why red: sibling-split — github/codeql-action parts bumped to 4.38.2 in separate PRs (#24, #25) — each is red until the others land. Group them in .github/dependabot.yml under the github-actions entry: groups: {codeql-action: {patterns: ["github/codeql-action*"]}}
  • why red: base-stale — test (macos-15), test (ubuntu-22.04) last passed on main 57d ago — re-run CI on main before blaming the bump: gh run list -R ictechgy/relay-continuity --branch main --limit 5
• ✋ hold #25 chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.38.2 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • CI failing: test (macos-15), Analyze (actions), test (ubuntu-22.04), Analyze (javascript-typescript), Analyze (rust)
  • why red: sibling-split — same as #24
  • why red: base-stale — same as #24
• ✋ hold #26 chore(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to 7e38f4b43b4db5c8dd498af069a4f6196df1d067
  • touches .github/workflows — the App has no workflows permission; owner merges
  • semver level unknown (no Dependabot update-type, no parsable versions)
  • CI failing: test (macos-15), test (ubuntu-22.04)
  • cooling: opened 15h ago, needs 72h
  • why red: base-stale — same as #24
• 💡 github-actions updates arrive one PR per action (#24, #25, #26) — group them under the github-actions entry: groups: {actions: {patterns: ["*"]}}

ictechgy/multi-account-tool — tier 1, complete, alerts disabled

• ⚠️ Dependabot alerts are disabled — nobody is told about vulnerable dependencies here. Enable them in Settings → Advanced Security (lychgate cannot: that needs administration)

Nothing pending. Still installable? Not verified — no smoke check yet.

ictechgy/kartograph — tier 1, active, alerts disabled

• ⚠️ Dependabot alerts are disabled — nobody is told about vulnerable dependencies here. Enable them in Settings → Advanced Security (lychgate cannot: that needs administration)
• ✋ hold #92 chore(deps): bump com.gradle.plugin-publish from 2.1.1 to 2.2.1 [minor]
  • CI failing: test, compatibility (17), compatibility (21), agp-minimum
  • why red: gradle-verification — this repo verifies gradle dependencies (gradle/verification-metadata.xml) and Dependabot does not update that file, so gradle bumps that change dependencies fail CI here — regenerate it on the PR branch: ./gradlew --write-verification-metadata sha256 help
• ✋ hold #115 chore(deps): bump gradle-wrapper from 9.7.1 to 9.8.0 [minor]
  • touches non-dependency files: gradle/wrapper/gradle-wrapper.jar, gradle/wrapper/gradle-wrapper.properties, gradlew.bat
  • CI failing: test, compatibility (17), compatibility (21), agp-minimum
  • why red: gradle-verification — same as #92
• ✋ hold #133 chore(deps): bump org.jetbrains.kotlinx.kover from 0.9.9 to 0.9.11 [patch]
  • CI failing: test, compatibility (17), compatibility (21), agp-minimum
  • cooling: opened 10h ago, needs 72h
  • why red: gradle-verification — same as #92
• ✋ hold #134 chore(deps): bump gradle/actions/setup-gradle from 6.3.0 to 6.4.0 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • cooling: opened 10h ago, needs 72h
  • your call — CI green, mergeable at head 14a52d1: gh pr merge 134 -R ictechgy/kartograph --squash --match-head-commit 14a52d110be891ee94afa017fe0c4124cef07ee4
• ✋ hold #135 chore(deps): bump gradle/actions/wrapper-validation from 6.3.0 to 6.4.0 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • cooling: opened 10h ago, needs 72h
  • your call — CI green, mergeable at head 395ad7f: gh pr merge 135 -R ictechgy/kartograph --squash --match-head-commit 395ad7f44eb85af38af775cdf48b4b505717c10e
• 💡 github-actions updates arrive one PR per action (#134, #135) — group them under the github-actions entry: groups: {actions: {patterns: ["*"]}}
• 💡 gradle bumps need you here until gradle/verification-metadata.xml is regenerated on each PR (#92, #115, #133) — or accept them as always-manual

ictechgy/filtering — tier 0, sunset-candidate, 176 open alert(s) (115 critical/high, 21 without a patch)

• 👁️ 20 open Dependabot PR(s) (12 patch, 5 minor, 3 major); oldest #1 is 2061d old — report only (tier 0, sunset-candidate)

ictechgy/ictechgy.github.io — tier 0, sunset-candidate, 56 open alert(s) (30 critical/high, 0 without a patch)

• 👁️ 5 open Dependabot PR(s) (5 patch); oldest #4 is 1976d old — report only (tier 0, sunset-candidate)