Daily Org Oversight Report — 2026-05-14 (UTC)

[fro-bot]

Snapshot: 2026-05-14 03:52 UTC. Scope: fro-bot/{agent, .github, systematic, fro-bot.github.io} (tokentoilet archived).

Summary metrics

Metric	Count	Δ vs. 2026-05-13
New issues (<24h, ex-automation)	0	0
Open PRs	6	−1
Aging PRs (>7d, ≤14d)	0	0
Stale PRs (>14d)	1	0
Stale issues (>30d)	2	0
Failing default-branch checks	0	0
Dependabot alerts (open)	5 (all agent)	0
Code-scanning alerts (open, high)	2 (agent) + 1 (.github)	0
Unassigned bugs (label:bug)	0	0

fro-bot/agent/main had a fresh push 3 min before snapshot — CI, CodeQL, Scorecard, and Update Repo Settings all green. PR #599 (eslint v10.3.0) merged since yesterday.

Critical items

Repo	Severity	Item	Recommended action
fro-bot/agent	high	fast-uri host confusion (Dependabot #71)	Day 5 unresolved. The recommendation to open a pnpm-workspace.overrides PR has now been repeated for three reports without movement.
fro-bot/agent	high	fast-uri path traversal (Dependabot #70)	Bundle.
fro-bot/agent	high	fast-xml-builder attribute-quote bypass (Dependabot #69)	Bundle.
fro-bot/agent	medium	fast-xml-builder comment-regex bypass (Dependabot #68)	Resolved alongside #69.
fro-bot/agent	medium	ip-address XSS in Address6 HTML methods (Dependabot #67)	Bump ip-address. Latent risk only.
fro-bot/agent	high (Scorecard)	BranchProtectionID, VulnerabilitiesID	Tighten main protection via common-settings.yaml; VulnerabilitiesID clears with the Dependabot block.
fro-bot/.github	high (Scorecard)	BranchProtectionID	Mirror agent's ruleset.

No failing default-branch CI. No broken release pipelines.

Aging PRs

PR	Idle	Note
fro-bot/systematic#2 — feat(deps): configure Renovate	18d	Fourth consecutive report flagging this. The recommendation hasn't changed: land or close.

All other open PRs were updated today.

Stale issues

Issue	Idle	Recommended next step
fro-bot/systematic#1 — Enable code scanning (CodeQL / Scorecard)	66d	Default branch is gh-pages (static docs); no buildable surface for CodeQL. Close as wontfix or rescope to Scorecard-only.
fro-bot/fro-bot.github.io#1 — Enable code scanning (CodeQL / Scorecard)	66d	Static-site repo; same shape. Close with same rationale.

44 daily automation-lifecycle issues in fro-bot/.github excluded.

Unassigned bugs / high-signal issues

label:bug + no:assignee org-wide: 0.

Repo hotspots

Rank	Repo	Open PRs	Stale items	Notes
1	fro-bot/agent	4	0	Queue moving (PR #599 merged, push to main this hour). Security block still untouched.
2	fro-bot/systematic	1	1	Same two parked items.
3	fro-bot/.github	1	0	Single Renovate action-bump PR (#3282).

Recommended actions

• Open the pnpm-workspace.overrides PR on fro-bot/agent for fast-uri, fast-xml-builder, and ip-address. Five cycles in, no movement. The "wait for Renovate" strategy has failed.
• Tighten main branch protection on fro-bot/agent and fro-bot/.github via common-settings.yaml.
• Land or close fro-bot/systematic#2 — 18d, four cycles flagged.
• Close or rescope fro-bot/systematic#1 and fro-bot/fro-bot.github.io#1.

The pattern across these reports is clear: the org's automation is healthy, but the manual decisions queued by past reports keep being deferred. Five days of recommending the same security fix is the report consuming its own tail. Marcus — these are blocking on a human decision, not on more data.

[fro-bot]

Auto-closed: daily report retention policy (3 days). Superseded by newer reports.