Lychgate digest — 2026-10-12 (dry-run)

0 would merge · 1 waiting · 13 need you · 0 unanswered issue(s) · 25 observed only

ictechgy/relay-continuity — tier 1, complete, 0 open alerts

• ⏳ wait #27 chore(deps): bump libc from 0.2.189 to 0.2.190 [patch]
  • cooling: opened 16h ago, needs 72h
• ✋ hold #28 chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.38.3 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • CI failing: test (macos-15), Analyze (actions), test (ubuntu-22.04), Analyze (javascript-typescript), Analyze (rust)
  • cooling: opened 15h ago, needs 72h
  • why red: sibling-split — github/codeql-action parts bumped to 4.38.3 in separate PRs (#28, #29) — each is red until the others land. Group them in .github/dependabot.yml under the github-actions entry: groups: {codeql-action: {patterns: ["github/codeql-action*"]}}
  • why red: base-stale — test (macos-15), test (ubuntu-22.04) last passed on main 64d ago — re-run CI on main before blaming the bump: gh run list -R ictechgy/relay-continuity --branch main --limit 5
• ✋ hold #29 chore(deps): bump github/codeql-action/init from 4.37.6 to 4.38.3 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • CI failing: test (macos-15), Analyze (actions), test (ubuntu-22.04), Analyze (javascript-typescript), Analyze (rust)
  • cooling: opened 15h ago, needs 72h
  • why red: sibling-split — same as #28
  • why red: base-stale — same as #28
• ✋ hold #30 chore(deps): bump dtolnay/rust-toolchain from 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 to e2a55d2ffb04f378e9626c28d38b36d230d1e12f
  • touches .github/workflows — the App has no workflows permission; owner merges
  • semver level unknown (no Dependabot update-type, no parsable versions)
  • CI failing: test (macos-15), test (ubuntu-22.04)
  • cooling: opened 15h ago, needs 72h
  • why red: base-stale — same as #28
• ✋ hold #31 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • CI failing: test (macos-15), test (ubuntu-22.04)
  • cooling: opened 15h ago, needs 72h
  • why red: base-stale — same as #28
• ✋ hold #32 chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 [patch]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • CI failing: test (macos-15), test (ubuntu-22.04)
  • cooling: opened 15h ago, needs 72h
  • why red: base-stale — same as #28
• 💡 github-actions updates arrive one PR per action (#28, #29, #30, #31, #32) — group them under the github-actions entry: groups: {actions: {patterns: ["*"]}}

ictechgy/multi-account-tool — tier 1, complete, alerts disabled

• ⚠️ Dependabot alerts are disabled — nobody is told about vulnerable dependencies here. Enable them in Settings → Advanced Security (lychgate cannot: that needs administration)

Nothing pending. Still installable? Not verified — no smoke check yet.

ictechgy/kartograph — tier 1, active, alerts disabled

• ⚠️ Dependabot alerts are disabled — nobody is told about vulnerable dependencies here. Enable them in Settings → Advanced Security (lychgate cannot: that needs administration)
• ✋ hold #92 chore(deps): bump com.gradle.plugin-publish from 2.1.1 to 2.2.1 [minor]
  • CI failing: test, compatibility (17), compatibility (21), agp-minimum
  • mergeability UNKNOWN (GitHub still computing)
  • why red: base-broken — test fail on main too — fix main first: gh run list -R ictechgy/kartograph --branch main --limit 5
  • why red: gradle-verification — this repo verifies gradle dependencies (gradle/verification-metadata.xml) and Dependabot does not update that file, so gradle bumps that change dependencies fail CI here — regenerate it on the PR branch: ./gradlew --write-verification-metadata sha256 help
• ✋ hold #133 chore(deps): bump org.jetbrains.kotlinx.kover from 0.9.9 to 0.9.11 [patch]
  • CI failing: test, compatibility (17), compatibility (21), agp-minimum
  • mergeability UNKNOWN (GitHub still computing)
  • why red: base-broken — same as #92
  • why red: gradle-verification — same as #92
• ✋ hold #134 chore(deps): bump gradle/actions/setup-gradle from 6.3.0 to 6.4.0 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • mergeability UNKNOWN (GitHub still computing)
• ✋ hold #135 chore(deps): bump gradle/actions/wrapper-validation from 6.3.0 to 6.4.0 [minor]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • mergeability UNKNOWN (GitHub still computing)
• ✋ hold #144 chore(deps): bump gradle-wrapper from 9.7.1 to 9.8.1 [minor]
  • touches non-dependency files: gradle/wrapper/gradle-wrapper.jar, gradle/wrapper/gradle-wrapper.properties, gradlew.bat
  • CI failing: test, compatibility (17), compatibility (21), agp-minimum
  • mergeability UNKNOWN (GitHub still computing)
  • cooling: opened 10h ago, needs 72h
  • why red: base-broken — same as #92
  • why red: gradle-verification — same as #92
• ✋ hold #145 chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 [patch]
  • touches .github/workflows — the App has no workflows permission; owner merges
  • CI failing: test
  • mergeability UNKNOWN (GitHub still computing)
  • cooling: opened 10h ago, needs 72h
  • why red: base-broken — same as #92
• ✋ hold #146 chore(deps): bump org.jetbrains.kotlin:kotlin-metadata-jvm from 2.4.20 to 2.4.21 [patch]
  • CI failing: test, compatibility (17), compatibility (21), agp-minimum
  • mergeability UNKNOWN (GitHub still computing)
  • cooling: opened 10h ago, needs 72h
  • why red: base-broken — same as #92
  • why red: gradle-verification — same as #92
• ✋ hold #147 chore(deps): bump jvm from 2.4.20 to 2.4.21 [patch]
  • CI failing: test, compatibility (17), compatibility (21), agp-minimum
  • mergeability UNKNOWN (GitHub still computing)
  • cooling: opened 10h ago, needs 72h
  • why red: base-broken — same as #92
  • why red: gradle-verification — same as #92
• 💡 github-actions updates arrive one PR per action (#134, #135, #145) — group them under the github-actions entry: groups: {actions: {patterns: ["*"]}}
• 💡 gradle bumps need you here until gradle/verification-metadata.xml is regenerated on each PR (#92, #133, #144, #146, #147) — or accept them as always-manual

ictechgy/filtering — tier 0, sunset-candidate, 179 open alert(s) (117 critical/high, 21 without a patch)

• 👁️ 20 open Dependabot PR(s) (12 patch, 5 minor, 3 major); oldest #1 is 2068d old — report only (tier 0, sunset-candidate)

ictechgy/ictechgy.github.io — tier 0, sunset-candidate, 57 open alert(s) (30 critical/high, 0 without a patch)

• 👁️ 5 open Dependabot PR(s) (5 patch); oldest #4 is 1983d old — report only (tier 0, sunset-candidate)