Dependabot queue: clear #170

No open Dependabot pull requests across the fleet.

Standards warnings

Warning- and notice-level annotations from each repository's latest standards-check run that vetted its default branch. Fleet callers run only on pull requests, so that is usually the run on the head commit of the PR that produced the default-branch head. A PR run lints only the files that PR changed (node-floor always checks the whole repo), so "no warnings" means that run was clean, not that the whole repository is. Routine notices (no Markdown, shell or YAML files, no workflows) are omitted, a notice repeated across repositories is shown once, and repositories with nothing to list are counted, not listed.

38 repositories checked: 0 with warnings or notices, 38 with none. 2 not checked.

Current rules: standards-check-v1 as of 2026-10-07. 0 run(s) predate current rules, so their results do not reflect them.

No warnings: no checked repository's latest run carried a warning or notice annotation worth listing.

• 38 repositories carry the same notice: "The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see [Ubuntu] ubuntu-latest label will use Ubuntu 26.04 in November 2026 actions/runner-images#14748"

Not checked

These repositories have no readable standards-check result. Their warnings, if any, are unknown — not absent.

Archived, not surveyed: smartwatermelon/dumbify, smartwatermelon/qwen-sidebar, smartwatermelon/scripts-archive, smartwatermelon/superpowers, smartwatermelon/superpowers-marketplace, smartwatermelon/x-thread-reader, nightowlstudiollc/kalshi-trader, nightowlstudiollc/mindy-donovan, nightowlstudiollc/networth-agent, nightowlstudiollc/photo-game-poc, twistedmelonman/Auramaur, twistedmelonman/TomatoBar, twistedmelonman/agents, twistedmelonman/anniversary, twistedmelonman/bash-config, twistedmelonman/beam-sre-kata, twistedmelonman/btop-config, twistedmelonman/cat-boxen, twistedmelonman/claude-sandbox, twistedmelonman/dig-config, twistedmelonman/git-config, twistedmelonman/lock-sync-old, twistedmelonman/mac-migration, twistedmelonman/markdownlint-config, twistedmelonman/ocean-dashboard-k8s, twistedmelonman/pre-commit-config, twistedmelonman/pre-commit-testing, twistedmelonman/ralph-burndown, twistedmelonman/sailpoint-sre, twistedmelonman/shellcheck-config, twistedmelonman/swm.dev-card, twistedmelonman/tidy-config, twistedmelonman/tilsit-caddy, twistedmelonman/transmission-filebot, twistedmelonman/vim-config, twistedmelonman/yamllint-config, twistedmelonman/yt-dlp-config.

Branch protection

Whether each repository's default branch is protected and requires standards-check / run-standards-check. Exempt repositories are unprotected by a recorded decision for their class; they are counted, not listed.

40 repositories surveyed: 38 require standards-check, 2 exempt, 0 need attention, 0 unreadable.

Exempt by class:

• fork: 1 — a fork is not ours to govern (decided 2026-10-21, dev-env#211)
• smartwatermelon-private: 1 — a private smartwatermelon repo is unprotected by need (decided 2026-10-12, dev-env#85)

No gaps: every surveyed repository requires standards-check or is exempt.

CodeQL

Whether each repository has CodeQL default setup turned on. Exempt repositories are left off by a recorded decision for their class; they are counted, not listed.

40 repositories surveyed: 30 configured, 1 exempt, 6 covered by Semgrep, 0 not configured, 3 with no code scanning, 0 with Semgrep coverage unreadable, 0 unreadable.

Exempt by class:

• fork: 1 — a fork is not ours to scan (decided 2026-10-21, dev-env#166)

Without paid Code Security

GitHub refuses code scanning on these private repositories until the paid GitHub Code Security add-on is enabled. Code Security is not bought, by decision (2026-10-21, dev-env#166). Semgrep CE is the substitute: a caller at .github/workflows/semgrep-scan.yml runs the reusable semgrep-scan.yml workflow from smartwatermelon/github-workflows.

Covered by Semgrep (CodeQL substitute)

• nightowlstudiollc/cleanroom
• nightowlstudiollc/financial-agent
• nightowlstudiollc/infinite-yaks
• nightowlstudiollc/night-owl-studio
• nightowlstudiollc/reliquarist
• nightowlstudiollc/tensegrity

No code scanning: paid Code Security not bought, no Semgrep caller

• nightowlstudiollc/kebab-tax
• nightowlstudiollc/kebab-tax-netlify
• smartwatermelon/claude-config-backup

Dependabot alerts

Whether each repository has Dependabot security alerts turned on. Off is a gap unless the repository is exempt.

40 repositories surveyed: 39 on, 1 exempt, 0 off, 0 unreadable.

Exempt by class:

• fork: 1 — a fork is not ours to govern (decided 2026-10-21)

No gaps: every surveyed repository has Dependabot security alerts on or is exempt.

Generated 2026-10-23 00:37 UTC by this run.

A digest older than a day or two is stale: the scheduled run may have
stopped. GitHub disables scheduled workflows in public repositories after
60 days without repository activity.