Daily watch: automated / bot PR triage (installers + maintenance)

[radical]

Daily watch: automated / bot PR triage

This is a standing tracker for non-human, non-Copilot bot PRs that tend to fall through the cracks — dependabot, dotnet-maestro, github-actions, aspire-repo-bot, plus the external installer bots (aspire-winget-bot on microsoft/winget-pkgs, the cask updater on microsoft/homebrew-aspire).

The goal is simple: every one of these PRs should end up merged or closed, not lingering. This issue is refreshed daily; state changes slower than that, so each row shows the PR age so stale items are obvious.

Snapshot: 2026-06-17 · Latest stable release: 13.4.5 (2026-06-17)

Copilot-authored PRs (copilot-swe-agent, copilot-pull-request-reviewer) are intentionally out of scope.

---

⚡ Easy wins (do these first)

No analysis needed — these are unambiguous.

Close now (stale / superseded / EOL — safe, bots regenerate where relevant):

• #14331 — backport to EOL release/13.1 (~133d).
• #18207 — superseded by Update PackageValidationBaselineVersion to 13.4.5 #18263 (baseline 13.4.5).
• #15942, #15954, #17834 — stale/conflicting dependabot npm bumps; Bump the npm_and_yarn group across 3 directories with 2 updates #18117 is the live one. Closing lets dependabot regenerate one clean grouped PR.

Approve + merge now (green checks, only blocked on review):

• #18279 — release/13.4 MongoDB.Driver backport, checks passing.
• #18117 — npm bump, mergeable + green (merge this, then close the three npm PRs above).
• #17546 — [Automated] skills bundle, checks passing.
• #17972 — [Automated] Github Models, checks passing.

One quick fix, then merge (already approved):

• #17883 — approved release/13.4 → main merge-back, just needs conflict resolution.

Everything below is the full breakdown with status and reasoning.

---

1. External installer PRs — HIGHEST PRIORITY

These track a real stable release reaching users via winget / brew.

Repo	PR	Version	Age	State	Action
microsoft/winget-pkgs	#389252	13.4.5	<1d	⚠️ Open, label Internal-Error-Dynamic-Scan	Winget-side validation infra error (not a manifest problem). Monitor; if not auto-cleared in ~24–48h, comment to re-trigger validation / ping winget moderators.
microsoft/homebrew-aspire	—	13.4.5	—	✅ Up to date	Cask updated to 13.4.5 (#15, merged 2026-06-17 05:33). No open PRs. Nothing to do.

Notes

• homebrew-aspire has zero open PRs and the cask matches the latest release — healthy.
• winget cadence is healthy (13.4.0/13.4.3 merged; the 13.4.4 PR #387958 was correctly closed-unmerged when 13.4.5 superseded it, matching brew skipping 13.4.4). Only the current 13.4.5 PR is stuck, on a transient winget dynamic-scan error.

---

2. microsoft/aspire bot PRs

Sorted oldest → newest. Age is from creation to snapshot date.

Release / backport / merge-back

PR	Title	Bot	Base	Age	State	Recommended action
#14331	[release/13.1] HTTPS dev cert opt-in for Redis	github-actions	release/13.1	~133d	4 checks failing, review required, repeatedly re-opened	Close. Backport to release/13.1, which is long past EOL (current is 13.4.x). Stale.
#17883	Merge release/13.4 to main after v13.4.1	aspire-repo-bot	main	~14d	✅ Approved but ❌ CONFLICTING	Resolve conflicts and merge. Approved release merge-back blocked only by conflicts — the clearest "fell through the cracks" item.
#18207	Update PackageValidationBaselineVersion → 13.4.4	aspire-repo-bot	main	~2d	38 checks failing	Close — superseded by #18263 (baseline 13.4.5).
#18263	Update PackageValidationBaselineVersion → 13.4.5	aspire-repo-bot	main	<1d	12 checks failing	Investigate failures, then merge. Supersedes #18207.
#18279	[release/13.4] Update MongoDB.Driver → 3.9.0	aspire-repo-bot	release/13.4	<1d	✅ Checks passing, review required	Ready for review → merge.

Scheduled maintenance PRs (auto-regenerated, piling up unmerged)

PR	Title	Bot	Age	State	Recommended action
#15070	[Automated] Update dependencies	github-actions	~100d	Review required, repeatedly re-opened	Review + merge, or close if obsolete. 100 days stale is a smell — confirm the generating workflow is still wanted.
#15441	[Automated] Update Playground Manifests	github-actions	~89d	Review required, repeatedly re-opened	Review + merge, or close.
#17546	[Automated] Update Aspire skills bundle	aspire-repo-bot	~21d	Checks pass, BLOCKED (review)	Ready for review → merge.
#17972	[Automated] Update Github Models	aspire-repo-bot	~11d	Checks pass, BLOCKED (review)	Ready for review → merge.
#17846	[Automated] Update API Surface Area	aspire-repo-bot	~15d	NO-MERGE label, BLOCKED	Leave — NO-MERGE indicates an intentional running-diff PR, not a merge candidate. Verify it's still serving that purpose.

Dependency bumps (dependabot / maestro)

PR	Title	Bot	Age	State	Recommended action
#15942	Bump npm_and_yarn across 54 dirs (3 updates)	dependabot	~71d	Failing	Close — stale. See dupes below.
#15954	Bump npm_and_yarn across 54 dirs (5 updates)	dependabot	~70d	Failing	Close — stale. Near-identical to #15942.
#16482	[main] Update dependencies from dotnet/arcade	dotnet-maestro	~51d	4 checks failing	Investigate failures; maestro will keep it current. Merge once green or close to let maestro re-open.
#17834	Bump npm_and_yarn across 4 dirs (2 updates)	dependabot	~15d	❌ CONFLICTING, failing	Close — stale/superseded. See dupes below.
#18117	Bump npm_and_yarn across 3 dirs (2 updates)	dependabot	~6d	✅ Mergeable, checks passing	Ready → merge. Newest, green npm bump.

---

3. Duplicates / superseded

• PackageValidationBaselineVersion: Update PackageValidationBaselineVersion to 13.4.4 #18207 (→13.4.4) is superseded by Update PackageValidationBaselineVersion to 13.4.5 #18263 (→13.4.5). Close Update PackageValidationBaselineVersion to 13.4.4 #18207.
• dependabot npm_and_yarn group: four overlapping PRs — Bump the npm_and_yarn group across 54 directories with 3 updates #15942, Bump the npm_and_yarn group across 54 directories with 5 updates #15954 (both 54-dir, ~70d, failing), Bump the npm_and_yarn group across 4 directories with 2 updates #17834 (4-dir, conflicting), and Bump the npm_and_yarn group across 3 directories with 2 updates #18117 (3-dir, green, ~6d). Bump the npm_and_yarn group across 3 directories with 2 updates #18117 reflects current main; the older three should be closed so dependabot recreates a single clean grouped PR. Closing them is safe — dependabot regenerates from the latest base.
• winget: the 13.4.4 PR was already correctly closed when 13.4.5 superseded it — no action.

---

4. Expected-but-missing PRs

• homebrew-aspire: expected per-release cask update is present and merged (13.4.5). ✅
• winget: expected per-release manifest PR is present (13.4.5, #389252). ✅
• No missing release-installer PR for the latest stable (13.4.5) on either channel. The release-driven installer automation fired on both.

---

5. Concrete steps

Ordered by priority.

1. [winget] Watch #389252. If Internal-Error-Dynamic-Scan hasn't cleared within ~24–48h, comment to re-trigger validation or ping a winget moderator — this is the only installer item blocking 13.4.5 from winget.
2. [Merge release/13.4 to main after v13.4.1 release #17883] Resolve release/13.4 → main merge conflicts and merge (already approved).
3. [[release/13.4] Update MongoDB.Driver to version 3.9.0 #18279] Review + merge (green, release/13.4 MongoDB.Driver backport).
4. [Update PackageValidationBaselineVersion to 13.4.5 #18263] Triage the 12 failing checks, then merge; close Update PackageValidationBaselineVersion to 13.4.4 #18207 (superseded).
5. [[Automated] Update Aspire skills bundle #17546], [[Automated] Update Github Models #17972] Review + merge (green automated maintenance PRs sitting on review-required).
6. [Bump the npm_and_yarn group across 3 directories with 2 updates #18117] Merge (green npm bump); close Bump the npm_and_yarn group across 54 directories with 3 updates #15942, Bump the npm_and_yarn group across 54 directories with 5 updates #15954, Bump the npm_and_yarn group across 4 directories with 2 updates #17834 so dependabot regenerates one clean grouped PR.
7. [[release/13.1] Make HTTPS developer certificate opt-in for Redis #14331] Close (backport to EOL release/13.1).
8. [[Automated] Update dependencies #15070], [[Automated] Update Playground Manifests #15441] Decide: review+merge or close. Both are ~3 months stale and keep auto-reopening — if the generating workflow is still wanted, get them merged; otherwise disable/fix the workflow.
9. [[main] Update dependencies from dotnet/arcade #16482] Investigate maestro check failures; merge when green or close to let maestro re-open fresh.
10. [[Automated] Update API Surface Area #17846] Leave (NO-MERGE running diff) — just confirm it's still intentional.

---

_{Generated by an automated bot-PR watch. Scope: dependabot, dotnet-maestro, github-actions, aspire-repo-bot on microsoft/aspire; aspire-winget-bot on microsoft/winget-pkgs; cask updater on microsoft/homebrew-aspire. Ages are relative to the snapshot date.}