{
 "schema": 1,
 "generated": "2026-09-25T05:29:26Z",
 "org": "codesweep-ai",
 "owner": "codesweep-ai",
 "about": "What to change in each project's dependencies, most urgent first. Each action is one change: its steps make it, its changes say what moves where, and each change says when it is done.",
 "workflow": [
  "Work in a clone of the project, on a branch off the commit named in repo.sha or newer.",
  "Take actions in order: every fix action, then plan, then routine. One action is one commit.",
  "An action's requires names the actions to make before it, and they come before it in this list.",
  "An action with options needs a person's choice: propose the recommended one, and make none of them unasked.",
  "Follow each step: run a command in its cwd, make an edit at its file and line, or do the task it names.",
  "Run the project's own gate before committing, as its AGENTS.md or CONTRIBUTING.md describes.",
  "An action is done when every change meets its done_when. The next build of this file drops it.",
  "A step's exit status is not its check: npm audit fix exits 0 whether or not it changed anything. Read each done_when in the files the steps leave.",
  "When a change cannot be made, say why, and propose the decline entry for deps-config.json in codesweep-ai/dashboards."
 ],
 "tiers": {
  "fix": "act now: a vulnerability, an end of life, or a fix-by date already passed",
  "plan": "schedule: a major behind, a denied license, an abandoned package, an advisory no code calls",
  "routine": "batch: minor and patch releases, sibling pins, licenses to name in the policy"
 },
 "links": {
  "page": "https://codesweep.ai/dashboards/deps",
  "data": "https://codesweep.ai/dashboards/deps.json",
  "sbom": "https://codesweep.ai/dashboards/deps.cdx.json",
  "feed": "https://codesweep.ai/dashboards/deps-feed.xml",
  "spec": "https://github.com/codesweep-ai/dashboards/blob/main/SPEC.md#the-actions-file"
 },
 "data_sources": [
  {
   "name": "GitHub repositories",
   "url": "https://github.com/codesweep-ai",
   "gives": "Each project's manifests, commit history and source code, and the tags of actions with no releases",
   "license": "each repository's own"
  },
  {
   "name": "Project status files",
   "url": "https://codesweep.ai/",
   "gives": "Each project's description",
   "license": "each project's own"
  },
  {
   "name": "The previous deps.json",
   "url": "https://codesweep.ai/dashboards/deps.json",
   "gives": "Trend history, when each gap was first seen, and facts about versions already looked up",
   "license": "this site's own"
  },
  {
   "name": "Go module proxy",
   "url": "https://proxy.golang.org",
   "gives": "Go module versions and release dates, Go release dates, and the modules govulncheck builds",
   "license": "none stated"
  },
  {
   "name": "npm registry",
   "url": "https://registry.npmjs.org",
   "gives": "The newest version and source repository of each direct npm package",
   "license": "none stated"
  },
  {
   "name": "PyPI",
   "url": "https://pypi.org",
   "gives": "The newest version of each Python package",
   "license": "none stated"
  },
  {
   "name": "Maven Central",
   "url": "https://repo1.maven.org",
   "gives": "Maven releases",
   "license": "none stated"
  },
  {
   "name": "Node.js release index",
   "url": "https://nodejs.org/dist/index.json",
   "gives": "Node.js releases and their dates",
   "license": "none stated"
  },
  {
   "name": "GitHub releases",
   "url": "https://docs.github.com/en/rest/releases",
   "gives": "Releases and their dates for GitHub Actions and for binaries downloaded from GitHub",
   "license": "each repository's own"
  },
  {
   "name": "Container registries",
   "url": "https://github.com/opencontainers/distribution-spec",
   "gives": "The tags of each container image, from Docker Hub, GitHub, Fedora and Google's registries",
   "license": "none stated"
  },
  {
   "name": "endoflife.date",
   "url": "https://endoflife.date",
   "gives": "Support and end-of-life dates for each release line, and which packages belong to which product",
   "license": "MIT"
  },
  {
   "name": "GitHub runner images",
   "url": "https://github.com/actions/runner-images",
   "gives": "The image and OS version each hosted runner label runs, and which labels are deprecated",
   "license": "MIT"
  },
  {
   "name": "Firecracker policies",
   "url": "https://github.com/firecracker-microvm/firecracker/blob/main/docs/RELEASE_POLICY.md",
   "gives": "Firecracker's supported release lines and dates, and the guest kernels each supports",
   "license": "Apache-2.0"
  },
  {
   "name": "OSV",
   "url": "https://osv.dev",
   "gives": "Advisories affecting each Go, npm and PyPI version and the Go standard library, with severity and fixed releases",
   "license": "each source database's, such as CC-BY-4.0 for GitHub's"
  },
  {
   "name": "Go vulnerability database, through govulncheck",
   "url": "https://pkg.go.dev/vuln/",
   "gives": "Whether a project's code calls what a Go advisory names, and which modules its build includes",
   "license": "CC-BY-4.0"
  },
  {
   "name": "CISA KEV catalog",
   "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "gives": "Which CVEs are exploited in the wild, and since when",
   "license": "CC0-1.0"
  },
  {
   "name": "FIRST EPSS",
   "url": "https://www.first.org/epss/",
   "gives": "How likely each CVE is to be exploited within 30 days",
   "license": "free, with attribution requested"
  },
  {
   "name": "Fedora Bodhi",
   "url": "https://bodhi.fedoraproject.org",
   "gives": "Fedora security updates pushed since an image was built, and each release's newest kernel build",
   "license": "none stated"
  },
  {
   "name": "deps.dev",
   "url": "https://deps.dev",
   "gives": "Each version's licenses, publish date, deprecation, provenance and repository, each repository's OpenSSF Scorecard, and what installing an npm version brings in",
   "license": "CC-BY-4.0"
  },
  {
   "name": "ClearlyDefined",
   "url": "https://clearlydefined.io",
   "gives": "The licenses scans found in each shipped package's files, and a license score",
   "license": "CC0-1.0"
  },
  {
   "name": "ScanCode LicenseDB",
   "url": "https://scancode-licensedb.aboutcode.org",
   "gives": "The category of a license the policy does not name, as a hint",
   "license": "CC-BY-4.0"
  },
  {
   "name": "Fedora mdapi",
   "url": "https://mdapi.fedoraproject.org",
   "gives": "The version a Fedora package name resolves to in a release, and the packages built beside it",
   "license": "none stated"
  },
  {
   "name": "Fedora Koji",
   "url": "https://koji.fedoraproject.org",
   "gives": "The source package each Fedora binary package was built from",
   "license": "none stated"
  },
  {
   "name": "Fedora dist-git",
   "url": "https://src.fedoraproject.org",
   "gives": "The license each Fedora source package's spec file states",
   "license": "each package's own"
  }
 ],
 "projects": [
  {
   "name": "campaign",
   "repo": {
    "url": "https://github.com/codesweep-ai/campaign",
    "clone": "https://github.com/codesweep-ai/campaign.git",
    "branch": "main",
    "sha": "00ac9d99e3194505dc4739f91497e663641ef2f8"
   },
   "counts": {
    "fix": 0,
    "plan": 5,
    "routine": 10
   },
   "actions": [
    {
     "id": "campaign:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 6 GitHub Actions in campaign",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages, actions/download-artifact show no repository activity in 90 days (OpenSSF Scorecard)"
     ],
     "steps": [
      {
       "edit": ".github/workflows/ci.yml",
       "line": 638,
       "text": "uses: actions/cache@v6",
       "from": "v4",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 94,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 125,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 1254,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 415,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 109,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/cache",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "6.1.0",
       "files": [
        ".github/workflows/ci.yml:638"
       ],
       "done_when": "the pin is on the newest major: 6.1.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/pages.yml:94"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:125"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/download-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v7",
       "to": "8.0.1",
       "files": [
        ".github/workflows/ci.yml:1254"
       ],
       "done_when": "the pin is on the newest major: 8.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/setup-node",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v6",
       "to": "7.0.0",
       "files": [
        ".github/workflows/ci.yml:415"
       ],
       "done_when": "the pin is on the newest major: 7.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:109"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "actions/cache",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v4"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:dep:runtime-node",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade Node.js to 24.21.0 in campaign",
     "result": "Moves to the newest major",
     "steps": [
      {
       "edit": ".github/workflows/ci.yml",
       "line": 417,
       "text": "move to 24.21.0",
       "from": "22.13",
       "to": "24.21.0"
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "node",
       "label": "Node.js",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "22.13",
       "to": "24.21.0",
       "files": [
        ".github/workflows/ci.yml:417"
       ],
       "lifecycle": {
        "product": "nodejs",
        "cycle": "22",
        "eol": "2027-04-30",
        "phase": "maintenance",
        "url": "https://endoflife.date/nodejs"
       },
       "done_when": "the pin is on the newest major: 24.21.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-dep-runtime-node",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "node",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "22.13"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:dep:github-com-react-react",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade react to 19.3.0 in campaign",
     "result": "Moves 4 packages that release together",
     "steps": [
      {
       "run": "npm install react@19.3.0 react-dom@19.3.0 && npm install -D @types/react@19.3.0 @types/react-dom@19.3.0",
       "cwd": "dispatch-viewer/app"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@types/react",
       "purl": "pkg:npm/%40types/react@18.3.31",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "18.3.31",
       "to": "19.3.0",
       "files": [
        "dispatch-viewer/app/package.json:22"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "@types/react-dom",
       "purl": "pkg:npm/%40types/react-dom@18.3.7",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "18.3.7",
       "to": "19.3.0",
       "files": [
        "dispatch-viewer/app/package.json:23"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "react",
       "purl": "pkg:npm/react@18.3.1",
       "scope": "direct",
       "status": "major",
       "level": "warning",
       "from": "18.3.1",
       "to": "19.3.0",
       "files": [
        "dispatch-viewer/app/package.json:17"
       ],
       "lifecycle": {
        "product": "react",
        "cycle": "18",
        "eol": null,
        "phase": "maintenance",
        "url": "https://endoflife.date/react"
       },
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "react-dom",
       "purl": "pkg:npm/react-dom@18.3.1",
       "scope": "direct",
       "status": "major",
       "level": "warning",
       "from": "18.3.1",
       "to": "19.3.0",
       "files": [
        "dispatch-viewer/app/package.json:18"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-dep-github-com-react-react",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "@types/react",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "18.3.31"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:devtools:campaign-dispatch-viewer-app-package-json",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade typescript to 7.0.2 in campaign/dispatch-viewer/app",
     "result": "Moves 1 dev dependency to their newest major",
     "why": "none of them ships",
     "steps": [
      {
       "run": "npm install -D typescript@7.0.2",
       "cwd": "dispatch-viewer/app"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "typescript",
       "purl": "pkg:npm/typescript@5.9.3",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "5.9.3",
       "to": "7.0.2",
       "files": [
        "dispatch-viewer/app/package.json:28"
       ],
       "done_when": "the pin is on the newest major: 7.0.2"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-devtools-campaign-dispatch-viewer-app-package-json",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "typescript",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "5.9.3"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:dep:image-wsl-ubuntu",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade WSL Ubuntu 24.04 to 26.04 in campaign",
     "result": "Moves to the newest major",
     "steps": [
      {
       "edit": ".github/workflows/ci.yml",
       "line": 164,
       "text": "move to 26.04",
       "from": "24.04",
       "to": "26.04"
      }
     ],
     "changes": [
      {
       "ecosystem": "image",
       "name": "wsl/ubuntu",
       "label": "WSL Ubuntu 24.04",
       "purl": "pkg:docker/wsl/ubuntu@24.04",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "24.04",
       "to": "26.04",
       "files": [
        ".github/workflows/ci.yml:164"
       ],
       "lifecycle": {
        "product": "ubuntu",
        "cycle": "24.04",
        "eol": "2029-05-31",
        "phase": "active",
        "url": "https://endoflife.date/ubuntu"
       },
       "done_when": "the pin is on the newest major: 26.04"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-dep-image-wsl-ubuntu",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "wsl/ubuntu",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "24.04"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:routine:runtime",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 1 toolchain in campaign",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go mod edit -modfile=go.golangci.mod -go=1.27.1",
       "cwd": "."
      },
      {
       "run": "go mod edit -go=1.27.1",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "go",
       "label": "Go toolchain",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.27.0",
       "to": "1.27.1",
       "files": [
        "go.golangci.mod:12",
        "go.mod:3"
       ],
       "lifecycle": {
        "product": "go",
        "cycle": "1.27",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/go"
       },
       "done_when": "the pin is 1.27.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-routine-runtime",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "go",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.27.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:routine:go",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 3 go modules in campaign",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go get -modfile=go.golangci.mod -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0",
       "cwd": "."
      },
      {
       "run": "go get go.yaml.in/yaml/v3@v3.0.5 && go mod tidy",
       "cwd": "."
      },
      {
       "run": "go get -modfile=go.golangci.mod golang.org/x/tools@v0.50.0",
       "cwd": "."
      },
      {
       "run": "go get -tool golang.org/x/tools/cmd/deadcode@v0.50.0 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/golangci/golangci-lint/v2",
       "purl": "pkg:golang/github.com/golangci/golangci-lint/v2@v2.13.1",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v2.13.1",
       "to": "v2.14.0",
       "files": [
        "go.golangci.mod:99"
       ],
       "done_when": "the pin is v2.14.0 or newer"
      },
      {
       "ecosystem": "go",
       "name": "go.yaml.in/yaml/v3",
       "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4",
       "scope": "direct",
       "status": "patch",
       "level": "info",
       "from": "v3.0.4",
       "to": "v3.0.5",
       "files": [
        "go.mod:7"
       ],
       "done_when": "the pin is v3.0.5 or newer"
      },
      {
       "ecosystem": "go",
       "name": "golang.org/x/tools",
       "purl": "pkg:golang/golang.org/x/tools@v0.49.0",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v0.49.0",
       "to": "v0.50.0",
       "files": [
        "go.golangci.mod:220",
        "go.mod:41"
       ],
       "done_when": "the pin is v0.50.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-routine-go",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "github.com/golangci/golangci-lint/v2",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v2.13.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:routine:npm",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 3 npm packages in campaign",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "evidence": [
      "puppeteer runs a script when npm installs it"
     ],
     "steps": [
      {
       "run": "npm install -D @types/node@26.6.2",
       "cwd": "dispatch-viewer/app"
      },
      {
       "run": "npm install -D puppeteer@25.12.0",
       "cwd": "dispatch-viewer/app"
      },
      {
       "run": "npm install -D vite@8.3.1",
       "cwd": "dispatch-viewer/app"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@types/node",
       "purl": "pkg:npm/%40types/node@26.4.1",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "26.4.1",
       "to": "26.6.2",
       "files": [
        "dispatch-viewer/app/package.json:21"
       ],
       "done_when": "the pin is 26.6.2 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "puppeteer",
       "purl": "pkg:npm/puppeteer@25.9.0",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "25.9.0",
       "to": "25.12.0",
       "files": [
        "dispatch-viewer/app/package.json:27"
       ],
       "done_when": "the pin is 25.12.0 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "vite",
       "purl": "pkg:npm/vite@8.2.2",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "8.2.2",
       "to": "8.3.1",
       "files": [
        "dispatch-viewer/app/package.json:29"
       ],
       "done_when": "the pin is 8.3.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-routine-npm",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "@types/node",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "26.4.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:sync:ui-npm-codesweep-ai-ui",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin @codesweep-ai/ui in campaign",
     "result": "Picks up up to 2 commits from ui",
     "steps": [
      {
       "run": "../../scripts/with-npmrevs.sh npm install --save-exact @codesweep-ai/ui@0.3.1-dev.20260924221206.9217a01",
       "cwd": "dispatch-viewer/app"
      },
      {
       "run": "make viewer-build",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@codesweep-ai/ui",
       "purl": "pkg:npm/%40codesweep-ai/ui@0.3.1-dev.20260924055243.a78ba79",
       "scope": "direct",
       "status": "behind",
       "level": "info",
       "from": "0.3.1-dev.20260924055243.a78ba79",
       "to": "0.3.1-dev.20260924221206.9217a01",
       "files": [
        "dispatch-viewer/app/package.json:15"
       ],
       "lag": {
        "commits": 2,
        "days": 0.7,
        "head": "9217a01ffda64d26d495486c4801d873799a254d",
        "pinned": "a78ba79",
        "built": "9217a01ffda64d26d495486c4801d873799a254d",
        "version": "0.3.1-dev.20260924221206.9217a01"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-sync-ui-npm-codesweep-ai-ui",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "@codesweep-ai/ui",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "0.3.1-dev.20260924055243.a78ba79"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:sync:ledger-go-github-com-codesweep-ai-ledger",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/ledger in campaign",
     "result": "Picks up up to 3 commits from ledger",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/ledger/cmd/cs-ledger@9c01ea57e8e2f26c9c48f9c315e25c604c085019 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/ledger",
       "purl": "pkg:golang/github.com/codesweep-ai/ledger@v0.0.0-20260924050924-dffe2aa34b39",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924050924-dffe2aa34b39",
       "to": "9c01ea5",
       "files": [
        "go.mod:13"
       ],
       "lag": {
        "commits": 3,
        "days": 0.7,
        "head": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "pinned": "dffe2aa34b39",
        "built": "9c01ea57e8e2f26c9c48f9c315e25c604c085019"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-sync-ledger-go-github-com-codesweep-ai-ledger",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "github.com/codesweep-ai/ledger",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924050924-dffe2aa34b39"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:sync:lint-go-github-com-codesweep-ai-lint",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/lint in campaign",
     "result": "Picks up up to 5 commits from lint",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/lint/cmd/cs-lint@341b79bde5204891a6e8074aa2a85e45bc009ecf && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/lint",
       "purl": "pkg:golang/github.com/codesweep-ai/lint@v0.0.0-20260924012322-5ffce6301cbf",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924012322-5ffce6301cbf",
       "to": "341b79b",
       "files": [
        "go.mod:14"
       ],
       "lag": {
        "commits": 5,
        "days": 0.9,
        "head": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "pinned": "5ffce6301cbf",
        "built": "341b79bde5204891a6e8074aa2a85e45bc009ecf"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-sync-lint-go-github-com-codesweep-ai-lint",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "github.com/codesweep-ai/lint",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924012322-5ffce6301cbf"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:sync:npmrevs-go-github-com-codesweep-ai-npmrevs",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/npmrevs in campaign",
     "result": "Picks up up to 4 commits from npmrevs",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/npmrevs/cmd/cs-npmrevs@6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/npmrevs",
       "purl": "pkg:golang/github.com/codesweep-ai/npmrevs@v0.0.0-20260924012324-0b587a7c4645",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924012324-0b587a7c4645",
       "to": "6bbb69b",
       "files": [
        "go.mod:15"
       ],
       "lag": {
        "commits": 4,
        "days": 0.9,
        "head": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504",
        "pinned": "0b587a7c4645",
        "built": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-sync-npmrevs-go-github-com-codesweep-ai-npmrevs",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "github.com/codesweep-ai/npmrevs",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924012324-0b587a7c4645"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:sync:sandbox-go-github-com-codesweep-ai-sandbox",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/sandbox in campaign",
     "result": "Picks up up to 2 commits from sandbox",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/sandbox/cmd/cs-sandbox@71db628021680f72f2bb847032f6525654ea2334 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/sandbox",
       "purl": "pkg:golang/github.com/codesweep-ai/sandbox@v0.0.0-20260924055525-5cbfbfe8734e",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924055525-5cbfbfe8734e",
       "to": "71db628",
       "files": [
        "go.mod:16"
       ],
       "lag": {
        "commits": 2,
        "days": 0.7,
        "head": "71db628021680f72f2bb847032f6525654ea2334",
        "pinned": "5cbfbfe8734e",
        "built": "71db628021680f72f2bb847032f6525654ea2334"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-sync-sandbox-go-github-com-codesweep-ai-sandbox",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "github.com/codesweep-ai/sandbox",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924055525-5cbfbfe8734e"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:sync:tracer-go-github-com-codesweep-ai-tracer",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/tracer in campaign",
     "result": "Picks up up to 2 commits from tracer",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/tracer/cmd/cs-tracer@b7bc54fd45c27578ec32d6a107993e0d73225bed && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/tracer",
       "purl": "pkg:golang/github.com/codesweep-ai/tracer@v0.0.0-20260924053404-19c407e0dd13",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924053404-19c407e0dd13",
       "to": "b7bc54f",
       "files": [
        "go.mod:17"
       ],
       "lag": {
        "commits": 2,
        "days": 0.7,
        "head": "b7bc54fd45c27578ec32d6a107993e0d73225bed",
        "pinned": "19c407e0dd13",
        "built": "b7bc54fd45c27578ec32d6a107993e0d73225bed"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-sync-tracer-go-github-com-codesweep-ai-tracer",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "github.com/codesweep-ai/tracer",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924053404-19c407e0dd13"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "campaign:sync:vcr-go-github-com-codesweep-ai-vcr",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/vcr in campaign",
     "result": "Picks up up to 4 commits from vcr",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/vcr/cmd/cs-vcr@85d428f1ef67c1fed364ad699a0b943c664771b9 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/vcr",
       "purl": "pkg:golang/github.com/codesweep-ai/vcr@v0.0.0-20260924052733-41c67be96268",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924052733-41c67be96268",
       "to": "85d428f",
       "files": [
        "go.mod:18"
       ],
       "lag": {
        "commits": 4,
        "days": 0.7,
        "head": "85d428f1ef67c1fed364ad699a0b943c664771b9",
        "pinned": "41c67be96268",
        "built": "85d428f1ef67c1fed364ad699a0b943c664771b9"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=campaign#action-sync-vcr-go-github-com-codesweep-ai-vcr",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "campaign",
       "name": "github.com/codesweep-ai/vcr",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924052733-41c67be96268"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  },
  {
   "name": "dashboards",
   "repo": {
    "url": "https://github.com/codesweep-ai/dashboards",
    "clone": "https://github.com/codesweep-ai/dashboards.git",
    "branch": "main",
    "sha": "066e52753f5b3be9681cc3f3f9279fb7356f5823"
   },
   "counts": {
    "fix": 0,
    "plan": 1,
    "routine": 4
   },
   "actions": [
    {
     "id": "dashboards:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 6 GitHub Actions in dashboards",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages has no repository activity in 90 days (OpenSSF Scorecard)"
     ],
     "steps": [
      {
       "edit": ".github/workflows/ci.yml",
       "line": 29,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 44,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 55,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 66,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 83,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 96,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/dashboard-ci.yml",
       "line": 22,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/dashboard-deps.yml",
       "line": 26,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 30,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 41,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 52,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 67,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 80,
       "text": "uses: actions/checkout@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/dashboard-deps.yml",
       "line": 55,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 115,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 160,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 30,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 45,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 56,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 71,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 86,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 97,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/dashboard-deps.yml",
       "line": 31,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 31,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 42,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 57,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 70,
       "text": "uses: actions/setup-go@v7",
       "from": "v5",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 96,
       "text": "uses: actions/setup-node@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 140,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/checkout",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "7.0.1",
       "files": [
        ".github/workflows/ci.yml:29",
        ".github/workflows/ci.yml:44",
        ".github/workflows/ci.yml:55",
        ".github/workflows/ci.yml:66",
        ".github/workflows/ci.yml:83",
        ".github/workflows/ci.yml:96",
        ".github/workflows/dashboard-ci.yml:22",
        ".github/workflows/dashboard-deps.yml:26",
        ".github/workflows/ledger.yml:30",
        ".github/workflows/ledger.yml:41",
        ".github/workflows/ledger.yml:52",
        ".github/workflows/ledger.yml:67",
        ".github/workflows/pages.yml:80"
       ],
       "done_when": "the pin is on the newest major: 7.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/dashboard-deps.yml:55",
        ".github/workflows/pages.yml:115"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:160"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/setup-go",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "7.0.0",
       "files": [
        ".github/workflows/ci.yml:30",
        ".github/workflows/ci.yml:45",
        ".github/workflows/ci.yml:56",
        ".github/workflows/ci.yml:71",
        ".github/workflows/ci.yml:86",
        ".github/workflows/ci.yml:97",
        ".github/workflows/dashboard-deps.yml:31",
        ".github/workflows/ledger.yml:31",
        ".github/workflows/ledger.yml:42",
        ".github/workflows/ledger.yml:57",
        ".github/workflows/ledger.yml:70"
       ],
       "done_when": "the pin is on the newest major: 7.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/setup-node",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "7.0.0",
       "files": [
        ".github/workflows/pages.yml:96"
       ],
       "done_when": "the pin is on the newest major: 7.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:140"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=dashboards#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "dashboards",
       "name": "actions/checkout",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v4"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "dashboards:routine:runtime",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 1 toolchain in dashboards",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go mod edit -go=1.27.1",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "go",
       "label": "Go toolchain",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.27.0",
       "to": "1.27.1",
       "files": [
        "go.mod:3"
       ],
       "lifecycle": {
        "product": "go",
        "cycle": "1.27",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/go"
       },
       "done_when": "the pin is 1.27.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=dashboards#action-routine-runtime",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "dashboards",
       "name": "go",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.27.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "dashboards:sync:ledger-go-github-com-codesweep-ai-ledger",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/ledger in dashboards",
     "result": "Picks up up to 31 commits from ledger",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/ledger/cmd/cs-ledger@9c01ea57e8e2f26c9c48f9c315e25c604c085019 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/ledger",
       "purl": "pkg:golang/github.com/codesweep-ai/ledger@v0.0.0-20260918043804-bbe29a48e449",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260918043804-bbe29a48e449",
       "to": "9c01ea5",
       "files": [
        "go.mod:16"
       ],
       "lag": {
        "commits": 31,
        "days": 6.7,
        "head": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "pinned": "bbe29a48e449",
        "built": "9c01ea57e8e2f26c9c48f9c315e25c604c085019"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=dashboards#action-sync-ledger-go-github-com-codesweep-ai-ledger",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "dashboards",
       "name": "github.com/codesweep-ai/ledger",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260918043804-bbe29a48e449"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "dashboards:sync:lint-go-github-com-codesweep-ai-lint",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/lint in dashboards",
     "result": "Picks up up to 24 commits from lint",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/lint/cmd/cs-lint@341b79bde5204891a6e8074aa2a85e45bc009ecf && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/lint",
       "purl": "pkg:golang/github.com/codesweep-ai/lint@v0.0.0-20260918041056-8bdc0656c767",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260918041056-8bdc0656c767",
       "to": "341b79b",
       "files": [
        "go.mod:17"
       ],
       "lag": {
        "commits": 24,
        "days": 6.8,
        "head": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "pinned": "8bdc0656c767",
        "built": "341b79bde5204891a6e8074aa2a85e45bc009ecf"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=dashboards#action-sync-lint-go-github-com-codesweep-ai-lint",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "dashboards",
       "name": "github.com/codesweep-ai/lint",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260918041056-8bdc0656c767"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "dashboards:sync:npmrevs-go-github-com-codesweep-ai-npmrevs",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/npmrevs in dashboards",
     "result": "Picks up up to 15 commits from npmrevs",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/npmrevs/cmd/cs-npmrevs@6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/npmrevs",
       "purl": "pkg:golang/github.com/codesweep-ai/npmrevs@v0.0.0-20260921040735-e92f1c0bd295",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260921040735-e92f1c0bd295",
       "to": "6bbb69b",
       "files": [
        "go.mod:18"
       ],
       "lag": {
        "commits": 15,
        "days": 3.8,
        "head": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504",
        "pinned": "e92f1c0bd295",
        "built": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=dashboards#action-sync-npmrevs-go-github-com-codesweep-ai-npmrevs",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "dashboards",
       "name": "github.com/codesweep-ai/npmrevs",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260921040735-e92f1c0bd295"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  },
  {
   "name": "ledger",
   "repo": {
    "url": "https://github.com/codesweep-ai/ledger",
    "clone": "https://github.com/codesweep-ai/ledger.git",
    "branch": "main",
    "sha": "9c01ea57e8e2f26c9c48f9c315e25c604c085019"
   },
   "counts": {
    "fix": 0,
    "plan": 4,
    "routine": 6
   },
   "actions": [
    {
     "id": "ledger:eol:nodejs-18-engines",
     "tier": "plan",
     "level": "warning",
     "type": "eol",
     "title": "Raise the Node.js engines floor past 18 in ledger",
     "result": "Node.js 18 ended 2025-04-30",
     "opened": "2025-04-30T00:00:00Z",
     "steps": [
      {
       "edit": "npm/ledger/package.json",
       "line": 8,
       "text": "raise engines.node",
       "from": ">=18.17"
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "node",
       "label": "Node.js",
       "scope": "engines",
       "status": "eol",
       "level": "warning",
       "to": "24.21.0",
       "files": [
        "npm/ledger/package.json:8"
       ],
       "lifecycle": {
        "product": "nodejs",
        "cycle": "18",
        "eol": "2025-04-30",
        "phase": "eol",
        "url": "https://endoflife.date/nodejs"
       },
       "done_when": "the pinned release line is supported past 90 days from now"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-eol-nodejs-18-engines",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "node",
       "finding": "eol",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 5 GitHub Actions in ledger",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages has no repository activity in 90 days (OpenSSF Scorecard)",
      "sigstore/cosign-installer is a third-party action pinned by a tag its owner can move"
     ],
     "steps": [
      {
       "edit": ".github/workflows/pages.yml",
       "line": 99,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 130,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 41,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 173,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 199,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 74,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/npm-images.yml",
       "line": 65,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/npm.yml",
       "line": 126,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 114,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/release.yml",
       "line": 28,
       "text": "uses: sigstore/cosign-installer@v4",
       "from": "v3",
       "to": "v4"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/pages.yml:99"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:130"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/setup-node",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v6",
       "to": "7.0.0",
       "files": [
        ".github/workflows/ci.yml:41",
        ".github/workflows/ci.yml:173",
        ".github/workflows/ci.yml:199",
        ".github/workflows/ledger.yml:74",
        ".github/workflows/npm-images.yml:65",
        ".github/workflows/npm.yml:126"
       ],
       "done_when": "the pin is on the newest major: 7.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:114"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "sigstore/cosign-installer",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "4.1.2",
       "files": [
        ".github/workflows/release.yml:28"
       ],
       "done_when": "the pin is on the newest major: 4.1.2"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "actions/configure-pages",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:dep:github-com-react-react",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade react to 19.3.0 in ledger",
     "result": "Moves 4 packages that release together",
     "steps": [
      {
       "run": "npm install react@19.3.0 react-dom@19.3.0 && npm install -D @types/react@19.3.0 @types/react-dom@19.3.0",
       "cwd": "viewer"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@types/react",
       "purl": "pkg:npm/%40types/react@18.3.31",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "18.3.31",
       "to": "19.3.0",
       "files": [
        "viewer/package.json:18"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "@types/react-dom",
       "purl": "pkg:npm/%40types/react-dom@18.3.7",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "18.3.7",
       "to": "19.3.0",
       "files": [
        "viewer/package.json:19"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "react",
       "purl": "pkg:npm/react@18.3.1",
       "scope": "direct",
       "status": "major",
       "level": "warning",
       "from": "18.3.1",
       "to": "19.3.0",
       "files": [
        "viewer/package.json:13"
       ],
       "lifecycle": {
        "product": "react",
        "cycle": "18",
        "eol": null,
        "phase": "maintenance",
        "url": "https://endoflife.date/react"
       },
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "react-dom",
       "purl": "pkg:npm/react-dom@18.3.1",
       "scope": "direct",
       "status": "major",
       "level": "warning",
       "from": "18.3.1",
       "to": "19.3.0",
       "files": [
        "viewer/package.json:14"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-dep-github-com-react-react",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "@types/react",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "18.3.31"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:devtools:ledger-viewer-package-json",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade typescript to 7.0.2 in ledger/viewer",
     "result": "Moves 1 dev dependency to their newest major",
     "why": "none of them ships",
     "steps": [
      {
       "run": "npm install -D typescript@7.0.2",
       "cwd": "viewer"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "typescript",
       "purl": "pkg:npm/typescript@5.9.3",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "5.9.3",
       "to": "7.0.2",
       "files": [
        "viewer/package.json:23"
       ],
       "done_when": "the pin is on the newest major: 7.0.2"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-devtools-ledger-viewer-package-json",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "typescript",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "5.9.3"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:sync:ui-npm-codesweep-ai-ui",
     "tier": "routine",
     "level": "warning",
     "type": "sync",
     "title": "Repin @codesweep-ai/ui in ledger",
     "result": "Picks up up to 144 commits from ui",
     "steps": [
      {
       "run": "../scripts/with-npmrevs.sh npm install --save-exact @codesweep-ai/ui@0.3.1-dev.20260924221206.9217a01",
       "cwd": "viewer"
      },
      {
       "run": "make viewer-repin",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@codesweep-ai/ui",
       "purl": "pkg:npm/%40codesweep-ai/ui@0.3.1-dev.20260909170256.1638d27",
       "scope": "direct",
       "status": "behind",
       "level": "warning",
       "from": "0.3.1-dev.20260909170256.1638d27",
       "to": "0.3.1-dev.20260924221206.9217a01",
       "files": [
        "viewer/package.json:11"
       ],
       "lag": {
        "commits": 144,
        "days": 15.2,
        "head": "9217a01ffda64d26d495486c4801d873799a254d",
        "pinned": "1638d27",
        "built": "9217a01ffda64d26d495486c4801d873799a254d",
        "version": "0.3.1-dev.20260924221206.9217a01"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-sync-ui-npm-codesweep-ai-ui",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "@codesweep-ai/ui",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "0.3.1-dev.20260909170256.1638d27"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:routine:runtime",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 1 toolchain in ledger",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go mod edit -modfile=go.golangci.mod -go=1.27.1",
       "cwd": "."
      },
      {
       "run": "go mod edit -go=1.27.1",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "go",
       "label": "Go toolchain",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.27.0",
       "to": "1.27.1",
       "files": [
        "go.golangci.mod:12",
        "go.mod:3"
       ],
       "lifecycle": {
        "product": "go",
        "cycle": "1.27",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/go"
       },
       "done_when": "the pin is 1.27.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-routine-runtime",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "go",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.27.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:routine:go",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 2 go modules in ledger",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go get -modfile=go.golangci.mod -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0",
       "cwd": "."
      },
      {
       "run": "go get -modfile=go.golangci.mod golang.org/x/tools@v0.50.0",
       "cwd": "."
      },
      {
       "run": "go get -tool golang.org/x/tools/cmd/deadcode@v0.50.0 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/golangci/golangci-lint/v2",
       "purl": "pkg:golang/github.com/golangci/golangci-lint/v2@v2.13.1",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v2.13.1",
       "to": "v2.14.0",
       "files": [
        "go.golangci.mod:99"
       ],
       "done_when": "the pin is v2.14.0 or newer"
      },
      {
       "ecosystem": "go",
       "name": "golang.org/x/tools",
       "purl": "pkg:golang/golang.org/x/tools@v0.49.0",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v0.49.0",
       "to": "v0.50.0",
       "files": [
        "go.golangci.mod:220",
        "go.mod:40"
       ],
       "done_when": "the pin is v0.50.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-routine-go",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "github.com/golangci/golangci-lint/v2",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v2.13.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:routine:npm",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 3 npm packages in ledger",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "npm install -D @types/node@26.6.2",
       "cwd": "viewer"
      },
      {
       "run": "npm install -D puppeteer-core@25.12.0",
       "cwd": "viewer"
      },
      {
       "run": "npm install -D vite@8.3.1",
       "cwd": "viewer"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@types/node",
       "purl": "pkg:npm/%40types/node@26.4.0",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "26.4.0",
       "to": "26.6.2",
       "files": [
        "viewer/package.json:17"
       ],
       "done_when": "the pin is 26.6.2 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "puppeteer-core",
       "purl": "pkg:npm/puppeteer-core@25.9.0",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "25.9.0",
       "to": "25.12.0",
       "files": [
        "viewer/package.json:21"
       ],
       "done_when": "the pin is 25.12.0 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "vite",
       "purl": "pkg:npm/vite@8.2.2",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "8.2.2",
       "to": "8.3.1",
       "files": [
        "viewer/package.json:24"
       ],
       "done_when": "the pin is 8.3.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-routine-npm",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "@types/node",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "26.4.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:sync:lint-go-github-com-codesweep-ai-lint",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/lint in ledger",
     "result": "Picks up up to 21 commits from lint",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/lint/cmd/cs-lint@341b79bde5204891a6e8074aa2a85e45bc009ecf && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/lint",
       "purl": "pkg:golang/github.com/codesweep-ai/lint@v0.0.0-20260920225222-bf7ecaaea067",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260920225222-bf7ecaaea067",
       "to": "341b79b",
       "files": [
        "go.mod:15"
       ],
       "lag": {
        "commits": 21,
        "days": 4.0,
        "head": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "pinned": "bf7ecaaea067",
        "built": "341b79bde5204891a6e8074aa2a85e45bc009ecf"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-sync-lint-go-github-com-codesweep-ai-lint",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "github.com/codesweep-ai/lint",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260920225222-bf7ecaaea067"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ledger:sync:npmrevs-go-github-com-codesweep-ai-npmrevs",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/npmrevs in ledger",
     "result": "Picks up up to 18 commits from npmrevs",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/npmrevs/cmd/cs-npmrevs@6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/npmrevs",
       "purl": "pkg:golang/github.com/codesweep-ai/npmrevs@v0.0.0-20260920020255-40937e144093",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260920020255-40937e144093",
       "to": "6bbb69b",
       "files": [
        "go.mod:16"
       ],
       "lag": {
        "commits": 18,
        "days": 4.8,
        "head": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504",
        "pinned": "40937e144093",
        "built": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ledger#action-sync-npmrevs-go-github-com-codesweep-ai-npmrevs",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ledger",
       "name": "github.com/codesweep-ai/npmrevs",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260920020255-40937e144093"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  },
  {
   "name": "lint",
   "repo": {
    "url": "https://github.com/codesweep-ai/lint",
    "clone": "https://github.com/codesweep-ai/lint.git",
    "branch": "main",
    "sha": "341b79bde5204891a6e8074aa2a85e45bc009ecf"
   },
   "counts": {
    "fix": 0,
    "plan": 2,
    "routine": 4
   },
   "actions": [
    {
     "id": "lint:eol:nodejs-18-engines",
     "tier": "plan",
     "level": "warning",
     "type": "eol",
     "title": "Raise the Node.js engines floor past 18 in lint",
     "result": "Node.js 18 ended 2025-04-30",
     "opened": "2025-04-30T00:00:00Z",
     "steps": [
      {
       "edit": "npm/lint/package.json",
       "line": 8,
       "text": "raise engines.node",
       "from": ">=18.17"
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "node",
       "label": "Node.js",
       "scope": "engines",
       "status": "eol",
       "level": "warning",
       "to": "24.21.0",
       "files": [
        "npm/lint/package.json:8"
       ],
       "lifecycle": {
        "product": "nodejs",
        "cycle": "18",
        "eol": "2025-04-30",
        "phase": "eol",
        "url": "https://endoflife.date/nodejs"
       },
       "done_when": "the pinned release line is supported past 90 days from now"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=lint#action-eol-nodejs-18-engines",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "lint",
       "name": "node",
       "finding": "eol",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "lint:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 5 GitHub Actions in lint",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages has no repository activity in 90 days (OpenSSF Scorecard)",
      "sigstore/cosign-installer is a third-party action pinned by a tag its owner can move"
     ],
     "steps": [
      {
       "edit": ".github/workflows/pages.yml",
       "line": 99,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 130,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/npm-images.yml",
       "line": 65,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/npm.yml",
       "line": 126,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 114,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/release.yml",
       "line": 31,
       "text": "uses: sigstore/cosign-installer@v4",
       "from": "v3",
       "to": "v4"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/pages.yml:99"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:130"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/setup-node",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v6",
       "to": "7.0.0",
       "files": [
        ".github/workflows/npm-images.yml:65",
        ".github/workflows/npm.yml:126"
       ],
       "done_when": "the pin is on the newest major: 7.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:114"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "sigstore/cosign-installer",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "4.1.2",
       "files": [
        ".github/workflows/release.yml:31"
       ],
       "done_when": "the pin is on the newest major: 4.1.2"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=lint#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "lint",
       "name": "actions/configure-pages",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "lint:routine:runtime",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 1 toolchain in lint",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go mod edit -modfile=go.golangci.mod -go=1.27.1",
       "cwd": "."
      },
      {
       "run": "go mod edit -go=1.27.1",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "go",
       "label": "Go toolchain",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.27.0",
       "to": "1.27.1",
       "files": [
        "go.golangci.mod:12",
        "go.mod:3"
       ],
       "lifecycle": {
        "product": "go",
        "cycle": "1.27",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/go"
       },
       "done_when": "the pin is 1.27.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=lint#action-routine-runtime",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "lint",
       "name": "go",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.27.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "lint:routine:go",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 2 go modules in lint",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go get -modfile=go.golangci.mod -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0",
       "cwd": "."
      },
      {
       "run": "go get -modfile=go.golangci.mod golang.org/x/tools@v0.50.0",
       "cwd": "."
      },
      {
       "run": "go get -tool golang.org/x/tools/cmd/deadcode@v0.50.0 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/golangci/golangci-lint/v2",
       "purl": "pkg:golang/github.com/golangci/golangci-lint/v2@v2.13.1",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v2.13.1",
       "to": "v2.14.0",
       "files": [
        "go.golangci.mod:99"
       ],
       "done_when": "the pin is v2.14.0 or newer"
      },
      {
       "ecosystem": "go",
       "name": "golang.org/x/tools",
       "purl": "pkg:golang/golang.org/x/tools@v0.49.0",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v0.49.0",
       "to": "v0.50.0",
       "files": [
        "go.golangci.mod:220",
        "go.mod:37"
       ],
       "done_when": "the pin is v0.50.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=lint#action-routine-go",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "lint",
       "name": "github.com/golangci/golangci-lint/v2",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v2.13.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "lint:sync:ledger-go-github-com-codesweep-ai-ledger",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/ledger in lint",
     "result": "Picks up up to 29 commits from ledger",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/ledger/cmd/cs-ledger@9c01ea57e8e2f26c9c48f9c315e25c604c085019 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/ledger",
       "purl": "pkg:golang/github.com/codesweep-ai/ledger@v0.0.0-20260920230337-e974225af350",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260920230337-e974225af350",
       "to": "9c01ea5",
       "files": [
        "go.mod:13"
       ],
       "lag": {
        "commits": 29,
        "days": 4.0,
        "head": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "pinned": "e974225af350",
        "built": "9c01ea57e8e2f26c9c48f9c315e25c604c085019"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=lint#action-sync-ledger-go-github-com-codesweep-ai-ledger",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "lint",
       "name": "github.com/codesweep-ai/ledger",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260920230337-e974225af350"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "lint:sync:npmrevs-go-github-com-codesweep-ai-npmrevs",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/npmrevs in lint",
     "result": "Picks up up to 15 commits from npmrevs",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/npmrevs/cmd/cs-npmrevs@6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/npmrevs",
       "purl": "pkg:golang/github.com/codesweep-ai/npmrevs@v0.0.0-20260921040735-e92f1c0bd295",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260921040735-e92f1c0bd295",
       "to": "6bbb69b",
       "files": [
        "go.mod:14"
       ],
       "lag": {
        "commits": 15,
        "days": 3.8,
        "head": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504",
        "pinned": "e92f1c0bd295",
        "built": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=lint#action-sync-npmrevs-go-github-com-codesweep-ai-npmrevs",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "lint",
       "name": "github.com/codesweep-ai/npmrevs",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260921040735-e92f1c0bd295"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  },
  {
   "name": "npmrevs",
   "repo": {
    "url": "https://github.com/codesweep-ai/npmrevs",
    "clone": "https://github.com/codesweep-ai/npmrevs.git",
    "branch": "main",
    "sha": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504"
   },
   "counts": {
    "fix": 0,
    "plan": 2,
    "routine": 5
   },
   "actions": [
    {
     "id": "npmrevs:eol:nodejs-18-engines",
     "tier": "plan",
     "level": "warning",
     "type": "eol",
     "title": "Raise the Node.js engines floor past 18 in npmrevs",
     "result": "Node.js 18 ended 2025-04-30",
     "opened": "2025-04-30T00:00:00Z",
     "steps": [
      {
       "edit": "npm/npmrevs/package.json",
       "line": 8,
       "text": "raise engines.node",
       "from": ">=18.17"
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "node",
       "label": "Node.js",
       "scope": "engines",
       "status": "eol",
       "level": "warning",
       "to": "24.21.0",
       "files": [
        "npm/npmrevs/package.json:8"
       ],
       "lifecycle": {
        "product": "nodejs",
        "cycle": "18",
        "eol": "2025-04-30",
        "phase": "eol",
        "url": "https://endoflife.date/nodejs"
       },
       "done_when": "the pinned release line is supported past 90 days from now"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=npmrevs#action-eol-nodejs-18-engines",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "npmrevs",
       "name": "node",
       "finding": "eol",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "npmrevs:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 5 GitHub Actions in npmrevs",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages has no repository activity in 90 days (OpenSSF Scorecard)",
      "sigstore/cosign-installer is a third-party action pinned by a tag its owner can move"
     ],
     "steps": [
      {
       "edit": ".github/workflows/pages.yml",
       "line": 94,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 125,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/npm-images.yml",
       "line": 65,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/npm.yml",
       "line": 126,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 109,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/release.yml",
       "line": 31,
       "text": "uses: sigstore/cosign-installer@v4",
       "from": "v3",
       "to": "v4"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/pages.yml:94"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:125"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/setup-node",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v6",
       "to": "7.0.0",
       "files": [
        ".github/workflows/npm-images.yml:65",
        ".github/workflows/npm.yml:126"
       ],
       "done_when": "the pin is on the newest major: 7.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:109"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "sigstore/cosign-installer",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "4.1.2",
       "files": [
        ".github/workflows/release.yml:31"
       ],
       "done_when": "the pin is on the newest major: 4.1.2"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=npmrevs#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "npmrevs",
       "name": "actions/configure-pages",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "npmrevs:routine:runtime",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 1 toolchain in npmrevs",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go mod edit -modfile=go.golangci.mod -go=1.27.1",
       "cwd": "."
      },
      {
       "run": "go mod edit -go=1.27.1",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "go",
       "label": "Go toolchain",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.27.0",
       "to": "1.27.1",
       "files": [
        "go.golangci.mod:12",
        "go.mod:3"
       ],
       "lifecycle": {
        "product": "go",
        "cycle": "1.27",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/go"
       },
       "done_when": "the pin is 1.27.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=npmrevs#action-routine-runtime",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "npmrevs",
       "name": "go",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.27.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "npmrevs:routine:go",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 3 go modules in npmrevs",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go get -modfile=go.golangci.mod -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0",
       "cwd": "."
      },
      {
       "run": "go get golang.org/x/crypto/x509roots/fallback@v0.0.0-20260921070245-7a4a4d6beae2 && go mod tidy",
       "cwd": "."
      },
      {
       "run": "go get -modfile=go.golangci.mod golang.org/x/tools@v0.50.0",
       "cwd": "."
      },
      {
       "run": "go get -tool golang.org/x/tools/cmd/deadcode@v0.50.0 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/golangci/golangci-lint/v2",
       "purl": "pkg:golang/github.com/golangci/golangci-lint/v2@v2.13.1",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v2.13.1",
       "to": "v2.14.0",
       "files": [
        "go.golangci.mod:99"
       ],
       "done_when": "the pin is v2.14.0 or newer"
      },
      {
       "ecosystem": "go",
       "name": "golang.org/x/crypto/x509roots/fallback",
       "purl": "pkg:golang/golang.org/x/crypto/x509roots/fallback@v0.0.0-20260916154351-b853e4b620cd",
       "scope": "direct",
       "status": "patch",
       "level": "info",
       "from": "v0.0.0-20260916154351-b853e4b620cd",
       "to": "v0.0.0-20260921070245-7a4a4d6beae2",
       "files": [
        "go.mod:8"
       ],
       "done_when": "the pin is v0.0.0-20260921070245-7a4a4d6beae2 or newer"
      },
      {
       "ecosystem": "go",
       "name": "golang.org/x/tools",
       "purl": "pkg:golang/golang.org/x/tools@v0.49.0",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v0.49.0",
       "to": "v0.50.0",
       "files": [
        "go.golangci.mod:220",
        "go.mod:36"
       ],
       "done_when": "the pin is v0.50.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=npmrevs#action-routine-go",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "npmrevs",
       "name": "github.com/golangci/golangci-lint/v2",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v2.13.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "npmrevs:sync:ledger-go-github-com-codesweep-ai-ledger",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/ledger in npmrevs",
     "result": "Picks up up to 31 commits from ledger",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/ledger/cmd/cs-ledger@9c01ea57e8e2f26c9c48f9c315e25c604c085019 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/ledger",
       "purl": "pkg:golang/github.com/codesweep-ai/ledger@v0.0.0-20260918043804-bbe29a48e449",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260918043804-bbe29a48e449",
       "to": "9c01ea5",
       "files": [
        "go.mod:15"
       ],
       "lag": {
        "commits": 31,
        "days": 6.7,
        "head": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "pinned": "bbe29a48e449",
        "built": "9c01ea57e8e2f26c9c48f9c315e25c604c085019"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=npmrevs#action-sync-ledger-go-github-com-codesweep-ai-ledger",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "npmrevs",
       "name": "github.com/codesweep-ai/ledger",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260918043804-bbe29a48e449"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "npmrevs:sync:lint-go-github-com-codesweep-ai-lint",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/lint in npmrevs",
     "result": "Picks up up to 24 commits from lint",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/lint/cmd/cs-lint@341b79bde5204891a6e8074aa2a85e45bc009ecf && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/lint",
       "purl": "pkg:golang/github.com/codesweep-ai/lint@v0.0.0-20260918041056-8bdc0656c767",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260918041056-8bdc0656c767",
       "to": "341b79b",
       "files": [
        "go.mod:16"
       ],
       "lag": {
        "commits": 24,
        "days": 6.8,
        "head": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "pinned": "8bdc0656c767",
        "built": "341b79bde5204891a6e8074aa2a85e45bc009ecf"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=npmrevs#action-sync-lint-go-github-com-codesweep-ai-lint",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "npmrevs",
       "name": "github.com/codesweep-ai/lint",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260918041056-8bdc0656c767"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "npmrevs:license:review-github-com-opencontainers-go-digest",
     "tier": "routine",
     "level": "idle",
     "type": "license",
     "title": "Review the license of github.com/opencontainers/go-digest in npmrevs",
     "result": "Checks a license the policy flags for review: Apache-2.0 AND CC-BY-SA-4.0",
     "why": "shipped in what the project builds",
     "opened": "2026-09-20T22:02:48Z",
     "steps": [
      {
       "do": "read the license terms, then allow it in deps-config.json or replace the package"
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/opencontainers/go-digest",
       "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0",
       "scope": "indirect",
       "status": "untracked",
       "level": "idle",
       "reason": "license",
       "from": "v1.0.0",
       "files": [
        "go.mod:26"
       ],
       "license": {
        "expression": "Apache-2.0 AND CC-BY-SA-4.0",
        "verdict": "review",
        "score": 60,
        "opened": "2026-09-20T22:02:48Z"
       },
       "done_when": "the license policy grades it allowed, or the dependency is gone"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=npmrevs#action-license-review-github-com-opencontainers-go-digest",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "npmrevs",
       "name": "github.com/opencontainers/go-digest",
       "finding": "license",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v1.0.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  },
  {
   "name": "sandbox",
   "repo": {
    "url": "https://github.com/codesweep-ai/sandbox",
    "clone": "https://github.com/codesweep-ai/sandbox.git",
    "branch": "main",
    "sha": "71db628021680f72f2bb847032f6525654ea2334"
   },
   "counts": {
    "fix": 1,
    "plan": 2,
    "routine": 10
   },
   "actions": [
    {
     "id": "sandbox:rebuild:sandbox-image-containerfile-base",
     "tier": "fix",
     "level": "critical",
     "type": "security",
     "title": "Rebuild sandbox's base image",
     "result": "Picks up 1 Fedora security update",
     "why": "shipped after the image was built on 2026-09-15",
     "opened": "2026-09-18T01:15:48Z",
     "steps": [
      {
       "do": "Rebuild the image that image/Containerfile.base describes, then point the pinned tag at the new build."
      },
      {
       "edit": "image/Containerfile.base",
       "line": 77,
       "text": "move to chromium-153.0.8010.36-1.fc44, chromium-153.0.8010.52-1.fc44",
       "to": "chromium-153.0.8010.36-1.fc44, chromium-153.0.8010.52-1.fc44"
      }
     ],
     "changes": [
      {
       "ecosystem": "package",
       "name": "chromium",
       "purl": "pkg:rpm/fedora/chromium@146.0.7680.80-1.fc44?distro=fedora-44",
       "scope": "build",
       "status": "vulnerable",
       "level": "critical",
       "to": "chromium-153.0.8010.36-1.fc44, chromium-153.0.8010.52-1.fc44",
       "files": [
        "image/Containerfile.base:77"
       ],
       "advisories": [
        {
         "id": "FEDORA-2026-f910229c11",
         "severity": "critical",
         "summary": "chromium-153.0.8010.52-1.fc44",
         "fixed": "chromium-153.0.8010.52-1.fc44",
         "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-f910229c11"
        },
        {
         "id": "FEDORA-2026-441ccd8509",
         "severity": "critical",
         "summary": "chromium-153.0.8010.36-1.fc44",
         "fixed": "chromium-153.0.8010.36-1.fc44",
         "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-441ccd8509"
        }
       ],
       "done_when": "the image image/Containerfile.base describes installs no build of chromium that FEDORA-2026-f910229c11 or FEDORA-2026-441ccd8509 affects"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-rebuild-sandbox-image-containerfile-base",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "chromium",
       "finding": "FEDORA-2026-f910229c11",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 5 GitHub Actions in sandbox",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages, actions/download-artifact show no repository activity in 90 days (OpenSSF Scorecard)"
     ],
     "steps": [
      {
       "edit": ".github/workflows/ci.yml",
       "line": 465,
       "text": "uses: actions/cache@v6",
       "from": "v4",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 100,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 131,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 534,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 649,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 654,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 748,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 863,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 868,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 951,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 1169,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 1517,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 115,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/cache",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "6.1.0",
       "files": [
        ".github/workflows/ci.yml:465"
       ],
       "done_when": "the pin is on the newest major: 6.1.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/pages.yml:100"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:131"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/download-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v7",
       "to": "8.0.1",
       "files": [
        ".github/workflows/ci.yml:534",
        ".github/workflows/ci.yml:649",
        ".github/workflows/ci.yml:654",
        ".github/workflows/ci.yml:748",
        ".github/workflows/ci.yml:863",
        ".github/workflows/ci.yml:868",
        ".github/workflows/ci.yml:951",
        ".github/workflows/ci.yml:1169",
        ".github/workflows/ci.yml:1517"
       ],
       "done_when": "the pin is on the newest major: 8.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:115"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "actions/cache",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v4"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:dep:image-wsl-ubuntu",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade WSL Ubuntu 24.04 to 26.04 in sandbox",
     "result": "Moves to the newest major",
     "steps": [
      {
       "edit": ".github/workflows/ci.yml",
       "line": 219,
       "text": "move to 26.04",
       "from": "24.04",
       "to": "26.04"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 958,
       "text": "move to 26.04",
       "from": "24.04",
       "to": "26.04"
      }
     ],
     "changes": [
      {
       "ecosystem": "image",
       "name": "wsl/ubuntu",
       "label": "WSL Ubuntu 24.04",
       "purl": "pkg:docker/wsl/ubuntu@24.04",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "24.04",
       "to": "26.04",
       "files": [
        ".github/workflows/ci.yml:219",
        ".github/workflows/ci.yml:958"
       ],
       "lifecycle": {
        "product": "ubuntu",
        "cycle": "24.04",
        "eol": "2029-05-31",
        "phase": "active",
        "url": "https://endoflife.date/ubuntu"
       },
       "done_when": "the pin is on the newest major: 26.04"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-dep-image-wsl-ubuntu",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "wsl/ubuntu",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "24.04"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:routine:go",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 2 go modules in sandbox",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go get -modfile=go.golangci.mod -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0",
       "cwd": "."
      },
      {
       "run": "go get -modfile=go.golangci.mod golang.org/x/tools@v0.50.0",
       "cwd": "."
      },
      {
       "run": "go get -tool golang.org/x/tools/cmd/deadcode@v0.50.0 && go mod tidy",
       "cwd": "."
      },
      {
       "edit": "image/Containerfile.base",
       "line": 337,
       "text": "set the version to v0.50.0",
       "from": "v0.49.0",
       "to": "v0.50.0"
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/golangci/golangci-lint/v2",
       "purl": "pkg:golang/github.com/golangci/golangci-lint/v2@v2.13.1",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v2.13.1",
       "to": "v2.14.0",
       "files": [
        "go.golangci.mod:99"
       ],
       "done_when": "the pin is v2.14.0 or newer"
      },
      {
       "ecosystem": "go",
       "name": "golang.org/x/tools",
       "purl": "pkg:golang/golang.org/x/tools@v0.49.0",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v0.49.0",
       "to": "v0.50.0",
       "files": [
        "go.golangci.mod:220",
        "go.mod:39",
        "image/Containerfile.base:337"
       ],
       "done_when": "the pin is v0.50.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-routine-go",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "github.com/golangci/golangci-lint/v2",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v2.13.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:routine:runtime",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 2 toolchains in sandbox",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go mod edit -modfile=go.golangci.mod -go=1.27.1",
       "cwd": "."
      },
      {
       "run": "go mod edit -go=1.27.1",
       "cwd": "."
      },
      {
       "edit": "image/Containerfile.base",
       "line": 273,
       "text": "set GO_VERSION to 1.27.1, with any checksum beside it",
       "from": "1.27.0",
       "to": "1.27.1"
      },
      {
       "edit": "image/Containerfile.base",
       "line": 210,
       "text": "move to 24.21.0",
       "from": "24.19.0",
       "to": "24.21.0"
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "go",
       "label": "Go toolchain",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.27.0",
       "to": "1.27.1",
       "files": [
        "go.golangci.mod:12",
        "go.mod:3",
        "image/Containerfile.base:273"
       ],
       "lifecycle": {
        "product": "go",
        "cycle": "1.27",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/go"
       },
       "done_when": "the pin is 1.27.1 or newer"
      },
      {
       "ecosystem": "runtime",
       "name": "node",
       "label": "Node.js",
       "scope": "build",
       "status": "minor",
       "level": "info",
       "from": "24.19.0",
       "to": "24.21.0",
       "files": [
        "image/Containerfile.base:210"
       ],
       "lifecycle": {
        "product": "nodejs",
        "cycle": "24",
        "eol": "2028-04-30",
        "phase": "active",
        "url": "https://endoflife.date/nodejs"
       },
       "done_when": "the pin is 24.21.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-routine-runtime",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "go",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.27.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:routine:native",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 8 native & binaries in sandbox",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "evidence": [
      "codex: OpenSSF Scorecard fails Code-Review (overall 5.9/10)"
     ],
     "steps": [
      {
       "edit": "image/Containerfile.agents",
       "line": 41,
       "text": "set the version to 2.1.282",
       "from": "2.1.258",
       "to": "2.1.282"
      },
      {
       "edit": "image/Containerfile.agents",
       "line": 94,
       "text": "set OPENCODE_VERSION to 1.18.32, with any checksum beside it",
       "from": "1.18.22",
       "to": "1.18.32"
      },
      {
       "edit": "image/Containerfile.base",
       "line": 301,
       "text": "set GOLANGCI_VERSION to 2.14.0, with any checksum beside it",
       "from": "2.13.1",
       "to": "2.14.0"
      },
      {
       "edit": "image/Containerfile.base",
       "line": 307,
       "text": "set GORELEASER_VERSION to 2.18.2, with any checksum beside it",
       "from": "2.18.0",
       "to": "2.18.2"
      },
      {
       "edit": "image/Containerfile.base",
       "line": 210,
       "text": "move to 0.40.8",
       "from": "v0.40.7",
       "to": "0.40.8"
      },
      {
       "edit": "image/Containerfile.agents",
       "line": 73,
       "text": "set CODEX_VERSION to 0.157.0, with any checksum beside it",
       "from": "0.152.1",
       "to": "0.157.0"
      },
      {
       "edit": "image/Containerfile.base",
       "line": 199,
       "text": "set the version to 2.8.6",
       "from": "v2.8.4",
       "to": "2.8.6"
      },
      {
       "do": "Pick a 6.18 kernel from the options"
      },
      {
       "edit": "internal/fcdisk/build.go",
       "line": 39,
       "text": "set the guest kernel to it",
       "from": "7.2.5-200.fc44"
      }
     ],
     "changes": [
      {
       "ecosystem": "native",
       "name": "@anthropic-ai/claude-code",
       "label": "Claude Code",
       "purl": "pkg:npm/%40anthropic-ai/claude-code@2.1.258",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "2.1.258",
       "to": "2.1.282",
       "files": [
        "image/Containerfile.agents:41"
       ],
       "done_when": "the pin is 2.1.282 or newer"
      },
      {
       "ecosystem": "native",
       "name": "github.com/anomalyco/opencode",
       "label": "opencode",
       "purl": "pkg:github/anomalyco/opencode@1.18.22",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.18.22",
       "to": "1.18.32",
       "files": [
        "image/Containerfile.agents:94"
       ],
       "done_when": "the pin is 1.18.32 or newer"
      },
      {
       "ecosystem": "native",
       "name": "github.com/golangci/golangci-lint",
       "label": "golangci-lint",
       "purl": "pkg:github/golangci/golangci-lint@2.13.1",
       "scope": "build",
       "status": "minor",
       "level": "info",
       "from": "2.13.1",
       "to": "2.14.0",
       "files": [
        "image/Containerfile.base:301"
       ],
       "done_when": "the pin is 2.14.0 or newer"
      },
      {
       "ecosystem": "native",
       "name": "github.com/goreleaser/goreleaser",
       "label": "goreleaser",
       "purl": "pkg:github/goreleaser/goreleaser@2.18.0",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "2.18.0",
       "to": "2.18.2",
       "files": [
        "image/Containerfile.base:307"
       ],
       "done_when": "the pin is 2.18.2 or newer"
      },
      {
       "ecosystem": "native",
       "name": "github.com/nvm-sh/nvm",
       "label": "nvm",
       "purl": "pkg:github/nvm-sh/nvm@v0.40.7",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "v0.40.7",
       "to": "0.40.8",
       "files": [
        "image/Containerfile.base:210"
       ],
       "lifecycle": {
        "product": "nvm",
        "cycle": "0.40",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/nvm"
       },
       "done_when": "the pin is 0.40.8 or newer"
      },
      {
       "ecosystem": "native",
       "name": "github.com/openai/codex",
       "label": "codex",
       "purl": "pkg:github/openai/codex@0.152.1",
       "scope": "build",
       "status": "minor",
       "level": "info",
       "from": "0.152.1",
       "to": "0.157.0",
       "files": [
        "image/Containerfile.agents:73"
       ],
       "done_when": "the pin is 0.157.0 or newer"
      },
      {
       "ecosystem": "native",
       "name": "github.com/pyenv/pyenv",
       "label": "pyenv",
       "purl": "pkg:github/pyenv/pyenv@v2.8.4",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "v2.8.4",
       "to": "2.8.6",
       "files": [
        "image/Containerfile.base:199"
       ],
       "done_when": "the pin is 2.8.6 or newer"
      },
      {
       "ecosystem": "native",
       "name": "kernel",
       "label": "Linux kernel (Fedora guest)",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "7.2.5-200.fc44",
       "to": "6.18 line",
       "files": [
        "internal/fcdisk/build.go:39"
       ],
       "lifecycle": {
        "product": "linux",
        "cycle": "7.2",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/linux"
       },
       "compat": {
        "with": "Firecracker",
        "line": "7.2",
        "validated": [
         "5.10",
         "6.1",
         "6.18"
        ],
        "ok": false,
        "guaranteed": {
         "5.10": "2024-01-31",
         "6.1": "2026-09-02",
         "6.18": "2028-06-01"
        },
        "requires": {
         "5.10": "1.0.0",
         "6.1": "1.9.0",
         "6.18": "1.16.1"
        },
        "url": "https://github.com/firecracker-microvm/firecracker/blob/main/docs/kernel-policy.md",
        "target": {
         "line": "6.18",
         "lts": true,
         "eol": "2028-12-31",
         "latest": "6.18.53",
         "guaranteed": "2028-06-01",
         "min_firecracker": "1.16.1"
        },
        "newer": {
         "ended": [
          "6.19",
          "7.0",
          "7.1"
         ],
         "not_validated": [
          "7.2"
         ]
        },
        "distribution": {
         "name": "Fedora 44",
         "latest": "7.2.7-200.fc44",
         "line": "7.2",
         "has_target": false
        },
        "firecracker": {
         "name": "github.com/firecracker-microvm/firecracker",
         "pinned": "1.17.0",
         "needs": "1.16.1",
         "ok": true
        }
       },
       "done_when": "on a line Firecracker validates (6.18)"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-routine-native",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "@anthropic-ai/claude-code",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "2.1.258"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:sync:sandbox-image-ghcr-io-codesweep-ai-sandbox-agents",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin ghcr.io/codesweep-ai/sandbox-agents in sandbox",
     "result": "Picks up up to 1 newer build from sandbox",
     "steps": [
      {
       "edit": "image/tiers.env",
       "line": 20,
       "text": "AGENTS_REF=v0.0.0-20260921030255-3d3fbb666359",
       "from": "v0.0.0-20260915163656-7aadd40781a8",
       "to": "v0.0.0-20260921030255-3d3fbb666359"
      }
     ],
     "changes": [
      {
       "ecosystem": "image",
       "name": "ghcr.io/codesweep-ai/sandbox-agents",
       "purl": "pkg:docker/codesweep-ai/sandbox-agents@v0.0.0-20260915163656-7aadd40781a8?repository_url=ghcr.io",
       "scope": "build",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260915163656-7aadd40781a8",
       "to": "v0.0.0-20260921030255-3d3fbb666359",
       "files": [
        "image/tiers.env:20"
       ],
       "lag": {
        "builds": 1,
        "days": 5.4
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-sync-sandbox-image-ghcr-io-codesweep-ai-sandbox-agents",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "ghcr.io/codesweep-ai/sandbox-agents",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260915163656-7aadd40781a8"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:sync:sandbox-image-ghcr-io-codesweep-ai-sandbox-slim-agents",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin ghcr.io/codesweep-ai/sandbox-slim-agents in sandbox",
     "result": "Picks up up to 1 newer build from sandbox",
     "steps": [
      {
       "edit": "image/tiers.env",
       "line": 21,
       "text": "SLIM_AGENTS_REF=v0.0.0-20260921030255-3d3fbb666359",
       "from": "v0.0.0-20260915163656-7aadd40781a8",
       "to": "v0.0.0-20260921030255-3d3fbb666359"
      }
     ],
     "changes": [
      {
       "ecosystem": "image",
       "name": "ghcr.io/codesweep-ai/sandbox-slim-agents",
       "purl": "pkg:docker/codesweep-ai/sandbox-slim-agents@v0.0.0-20260915163656-7aadd40781a8?repository_url=ghcr.io",
       "scope": "build",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260915163656-7aadd40781a8",
       "to": "v0.0.0-20260921030255-3d3fbb666359",
       "files": [
        "image/tiers.env:21"
       ],
       "lag": {
        "builds": 1,
        "days": 5.4
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-sync-sandbox-image-ghcr-io-codesweep-ai-sandbox-slim-agents",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "ghcr.io/codesweep-ai/sandbox-slim-agents",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260915163656-7aadd40781a8"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:sync:ledger-go-github-com-codesweep-ai-ledger",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/ledger in sandbox",
     "result": "Picks up up to 3 commits from ledger",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/ledger/cmd/cs-ledger@9c01ea57e8e2f26c9c48f9c315e25c604c085019 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/ledger",
       "purl": "pkg:golang/github.com/codesweep-ai/ledger@v0.0.0-20260924050924-dffe2aa34b39",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924050924-dffe2aa34b39",
       "to": "9c01ea5",
       "files": [
        "go.mod:14"
       ],
       "lag": {
        "commits": 3,
        "days": 0.7,
        "head": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "pinned": "dffe2aa34b39",
        "built": "9c01ea57e8e2f26c9c48f9c315e25c604c085019"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-sync-ledger-go-github-com-codesweep-ai-ledger",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "github.com/codesweep-ai/ledger",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924050924-dffe2aa34b39"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:sync:lint-go-github-com-codesweep-ai-lint",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/lint in sandbox",
     "result": "Picks up up to 5 commits from lint",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/lint/cmd/cs-lint@341b79bde5204891a6e8074aa2a85e45bc009ecf && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/lint",
       "purl": "pkg:golang/github.com/codesweep-ai/lint@v0.0.0-20260924012322-5ffce6301cbf",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924012322-5ffce6301cbf",
       "to": "341b79b",
       "files": [
        "go.mod:15"
       ],
       "lag": {
        "commits": 5,
        "days": 0.9,
        "head": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "pinned": "5ffce6301cbf",
        "built": "341b79bde5204891a6e8074aa2a85e45bc009ecf"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-sync-lint-go-github-com-codesweep-ai-lint",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "github.com/codesweep-ai/lint",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924012322-5ffce6301cbf"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:sync:npmrevs-go-github-com-codesweep-ai-npmrevs",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/npmrevs in sandbox",
     "result": "Picks up up to 4 commits from npmrevs",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/npmrevs/cmd/cs-npmrevs@6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/npmrevs",
       "purl": "pkg:golang/github.com/codesweep-ai/npmrevs@v0.0.0-20260924012324-0b587a7c4645",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924012324-0b587a7c4645",
       "to": "6bbb69b",
       "files": [
        "go.mod:16"
       ],
       "lag": {
        "commits": 4,
        "days": 0.9,
        "head": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504",
        "pinned": "0b587a7c4645",
        "built": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-sync-npmrevs-go-github-com-codesweep-ai-npmrevs",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "github.com/codesweep-ai/npmrevs",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924012324-0b587a7c4645"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:sync:tracer-go-github-com-codesweep-ai-tracer",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/tracer in sandbox",
     "result": "Picks up up to 2 commits from tracer",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/tracer/cmd/cs-tracer@b7bc54fd45c27578ec32d6a107993e0d73225bed && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/tracer",
       "purl": "pkg:golang/github.com/codesweep-ai/tracer@v0.0.0-20260924053404-19c407e0dd13",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924053404-19c407e0dd13",
       "to": "b7bc54f",
       "files": [
        "go.mod:17"
       ],
       "lag": {
        "commits": 2,
        "days": 0.7,
        "head": "b7bc54fd45c27578ec32d6a107993e0d73225bed",
        "pinned": "19c407e0dd13",
        "built": "b7bc54fd45c27578ec32d6a107993e0d73225bed"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-sync-tracer-go-github-com-codesweep-ai-tracer",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "github.com/codesweep-ai/tracer",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924053404-19c407e0dd13"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "sandbox:sync:vcr-go-github-com-codesweep-ai-vcr",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/vcr in sandbox",
     "result": "Picks up up to 4 commits from vcr",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/vcr/cmd/cs-vcr@85d428f1ef67c1fed364ad699a0b943c664771b9 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/vcr",
       "purl": "pkg:golang/github.com/codesweep-ai/vcr@v0.0.0-20260924052733-41c67be96268",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924052733-41c67be96268",
       "to": "85d428f",
       "files": [
        "go.mod:18"
       ],
       "lag": {
        "commits": 4,
        "days": 0.7,
        "head": "85d428f1ef67c1fed364ad699a0b943c664771b9",
        "pinned": "41c67be96268",
        "built": "85d428f1ef67c1fed364ad699a0b943c664771b9"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=sandbox#action-sync-vcr-go-github-com-codesweep-ai-vcr",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "sandbox",
       "name": "github.com/codesweep-ai/vcr",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924052733-41c67be96268"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  },
  {
   "name": "tracer",
   "repo": {
    "url": "https://github.com/codesweep-ai/tracer",
    "clone": "https://github.com/codesweep-ai/tracer.git",
    "branch": "main",
    "sha": "b7bc54fd45c27578ec32d6a107993e0d73225bed"
   },
   "counts": {
    "fix": 3,
    "plan": 4,
    "routine": 7
   },
   "actions": [
    {
     "id": "tracer:dep:github-com-vitest-dev-vitest",
     "tier": "fix",
     "level": "serious",
     "type": "security",
     "title": "Upgrade vitest to 4.1.11 in tracer",
     "result": "Fixes 6 advisories",
     "evidence": [
      "esbuild runs a script when npm installs it"
     ],
     "opened": "2025-02-10T17:48:07Z",
     "epss": 0.0098,
     "steps": [
      {
       "run": "npm install -D vitest@4.1.11",
       "cwd": "apps/viewer"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "vitest",
       "purl": "pkg:npm/vitest@2.1.9",
       "scope": "dev",
       "status": "vulnerable",
       "level": "serious",
       "from": "2.1.9",
       "to": "4.1.11",
       "files": [
        "apps/viewer/package.json:45"
       ],
       "advisories": [
        {
         "id": "GHSA-5xrq-8626-4rwp",
         "aliases": [
          "CVE-2026-47429"
         ],
         "severity": "critical",
         "summary": "When Vitest UI server is listening, arbitrary file can be read and executed",
         "fixed": "3.2.6",
         "url": "https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp",
         "epss": {
          "probability": 0.0088,
          "percentile": 0.5722
         }
        },
        {
         "id": "GHSA-82fw-gwwq-j7x9",
         "aliases": [
          "CVE-2026-84373"
         ],
         "severity": "moderate",
         "summary": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
         "fixed": "4.1.11",
         "url": "https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9",
         "epss": {
          "probability": 0.0053,
          "percentile": 0.4215
         }
        }
       ],
       "done_when": "apps/viewer/package-lock.json carries no copy of vitest that GHSA-5xrq-8626-4rwp or GHSA-82fw-gwwq-j7x9 affects"
      },
      {
       "ecosystem": "npm",
       "name": "@vitest/mocker",
       "purl": "pkg:npm/%40vitest/mocker@2.1.9",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "2.1.9",
       "to": "4.1.11",
       "files": [
        "apps/viewer/package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-82fw-gwwq-j7x9",
         "aliases": [
          "CVE-2026-84373"
         ],
         "severity": "moderate",
         "summary": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
         "fixed": "4.1.11",
         "url": "https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9",
         "epss": {
          "probability": 0.0053,
          "percentile": 0.4215
         }
        }
       ],
       "cleared_by": [
        "vitest"
       ],
       "done_when": "apps/viewer/package-lock.json carries no copy of @vitest/mocker that GHSA-82fw-gwwq-j7x9 affects"
      },
      {
       "ecosystem": "npm",
       "name": "esbuild",
       "purl": "pkg:npm/esbuild@0.21.5",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "0.21.5",
       "to": "0.25.0",
       "files": [
        "apps/viewer/package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-67mh-4wv8-2f99",
         "severity": "moderate",
         "summary": "esbuild enables any website to send any requests to the development server and read the response",
         "fixed": "0.25.0",
         "url": "https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99"
        }
       ],
       "cleared_by": [
        "vitest"
       ],
       "done_when": "apps/viewer/package-lock.json carries no copy of esbuild that GHSA-67mh-4wv8-2f99 affects"
      },
      {
       "ecosystem": "npm",
       "name": "vite",
       "purl": "pkg:npm/vite@5.4.21",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "5.4.21",
       "to": "6.4.3",
       "files": [
        "apps/viewer/package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-fx2h-pf6j-xcff",
         "aliases": [
          "CVE-2026-53571"
         ],
         "severity": "high",
         "summary": "vite: `server.fs.deny` bypass on Windows alternate paths",
         "fixed": "6.4.3",
         "url": "https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff",
         "epss": {
          "probability": 0.0058,
          "percentile": 0.4512
         }
        },
        {
         "id": "GHSA-4w7w-66w2-5vf9",
         "aliases": [
          "CVE-2026-39365"
         ],
         "severity": "moderate",
         "summary": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
         "fixed": "6.4.2",
         "url": "https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9",
         "epss": {
          "probability": 0.0098,
          "percentile": 0.6065
         }
        },
        {
         "id": "GHSA-v6wh-96g9-6wx3",
         "aliases": [
          "CVE-2026-53632"
         ],
         "severity": "moderate",
         "summary": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
         "fixed": "6.4.3",
         "url": "https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3",
         "epss": {
          "probability": 0.0041,
          "percentile": 0.3228
         }
        }
       ],
       "cleared_by": [
        "vitest"
       ],
       "done_when": "apps/viewer/package-lock.json carries no copy of vite that GHSA-fx2h-pf6j-xcff, GHSA-4w7w-66w2-5vf9 or GHSA-v6wh-96g9-6wx3 affects"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-dep-github-com-vitest-dev-vitest",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "vitest",
       "finding": "GHSA-5xrq-8626-4rwp",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "2.1.9"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:lock:tracer-fixtures-test-package-lock-json",
     "tier": "fix",
     "level": "serious",
     "type": "security",
     "title": "Refresh the lockfile in tracer/fixtures/test",
     "result": "Fixes 4 advisories",
     "why": "1 installed package, worst high, all dev only",
     "opened": "2026-09-02T15:41:53Z",
     "epss": 0.004,
     "steps": [
      {
       "run": "npm audit fix",
       "cwd": "fixtures/test"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "fast-uri",
       "purl": "pkg:npm/fast-uri@3.1.5",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "3.1.5",
       "to": "3.1.6",
       "files": [
        "fixtures/test/package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-5jgf-p345-68v8",
         "aliases": [
          "CVE-2026-75931"
         ],
         "severity": "high",
         "summary": "fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references",
         "fixed": "3.1.6",
         "url": "https://osv.dev/vulnerability/GHSA-5jgf-p345-68v8",
         "epss": {
          "probability": 0.004,
          "percentile": 0.3118
         }
        },
        {
         "id": "GHSA-f65p-4m7j-42xc",
         "aliases": [
          "CVE-2026-75975"
         ],
         "severity": "high",
         "summary": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",
         "fixed": "3.1.6",
         "url": "https://osv.dev/vulnerability/GHSA-f65p-4m7j-42xc",
         "epss": {
          "probability": 0.0038,
          "percentile": 0.2887
         }
        },
        {
         "id": "GHSA-fph4-wmhf-6fwf",
         "aliases": [
          "CVE-2026-75899"
         ],
         "severity": "high",
         "summary": "fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding",
         "fixed": "3.1.6",
         "url": "https://osv.dev/vulnerability/GHSA-fph4-wmhf-6fwf",
         "epss": {
          "probability": 0.0038,
          "percentile": 0.2887
         }
        },
        {
         "id": "GHSA-jqff-g426-hqxp",
         "aliases": [
          "CVE-2026-76172"
         ],
         "severity": "high",
         "summary": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization",
         "fixed": "3.1.6",
         "url": "https://osv.dev/vulnerability/GHSA-jqff-g426-hqxp",
         "epss": {
          "probability": 0.004,
          "percentile": 0.3118
         }
        }
       ],
       "done_when": "fixtures/test/package-lock.json carries no copy of fast-uri that GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf or GHSA-jqff-g426-hqxp affects"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-lock-tracer-fixtures-test-package-lock-json",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "fast-uri",
       "finding": "GHSA-5jgf-p345-68v8",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "3.1.5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:eol:eslint-9",
     "tier": "fix",
     "level": "serious",
     "type": "eol",
     "title": "Move off ESLint 9 in tracer",
     "result": "ESLint 9 ended 2026-08-06",
     "evidence": [
      "deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options."
     ],
     "opened": "2026-08-06T00:00:00Z",
     "steps": [
      {
       "run": "npm install -D eslint@10.11.0",
       "cwd": "apps/viewer"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "eslint",
       "purl": "pkg:npm/eslint@9.39.5",
       "scope": "dev",
       "status": "eol",
       "level": "serious",
       "from": "9.39.5",
       "to": "10.11.0",
       "files": [
        "apps/viewer/package.json:35"
       ],
       "lifecycle": {
        "product": "eslint",
        "cycle": "9",
        "eol": "2026-08-06",
        "phase": "eol",
        "url": "https://endoflife.date/eslint"
       },
       "done_when": "the pinned release line is supported past 90 days from now"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-eol-eslint-9",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "eslint",
       "finding": "eol",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "9.39.5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 4 GitHub Actions in tracer",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages has no repository activity in 90 days (OpenSSF Scorecard)"
     ],
     "steps": [
      {
       "edit": ".github/workflows/pages.yml",
       "line": 94,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 125,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 170,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 109,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/pages.yml:94"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:125"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/setup-node",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v6",
       "to": "7.0.0",
       "files": [
        ".github/workflows/ci.yml:170"
       ],
       "done_when": "the pin is on the newest major: 7.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:109"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "actions/configure-pages",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:devtools:tracer-apps-viewer-package-json",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade 9 dev tools in tracer/apps/viewer",
     "result": "Moves 9 dev dependencies to their newest major",
     "why": "none of them ships",
     "steps": [
      {
       "run": "npm install -D @eslint/js@10.0.1 @testing-library/jest-dom@7.0.1 @types/node@26.6.2 @vitejs/plugin-react@6.1.1 eslint-plugin-react-hooks@7.1.1 globals@17.12.0 jsdom@30.1.1 typescript@7.0.2 vite@8.3.1",
       "cwd": "apps/viewer"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@eslint/js",
       "purl": "pkg:npm/%40eslint/js@9.39.5",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "9.39.5",
       "to": "10.0.1",
       "files": [
        "apps/viewer/package.json:27"
       ],
       "done_when": "the pin is on the newest major: 10.0.1"
      },
      {
       "ecosystem": "npm",
       "name": "@testing-library/jest-dom",
       "purl": "pkg:npm/%40testing-library/jest-dom@6.9.1",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "6.9.1",
       "to": "7.0.1",
       "files": [
        "apps/viewer/package.json:28"
       ],
       "done_when": "the pin is on the newest major: 7.0.1"
      },
      {
       "ecosystem": "npm",
       "name": "@types/node",
       "purl": "pkg:npm/%40types/node@22.20.1",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "22.20.1",
       "to": "26.6.2",
       "files": [
        "apps/viewer/package.json:30"
       ],
       "done_when": "the pin is on the newest major: 26.6.2"
      },
      {
       "ecosystem": "npm",
       "name": "@vitejs/plugin-react",
       "purl": "pkg:npm/%40vitejs/plugin-react@4.7.0",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "4.7.0",
       "to": "6.1.1",
       "files": [
        "apps/viewer/package.json:33"
       ],
       "done_when": "the pin is on the newest major: 6.1.1"
      },
      {
       "ecosystem": "npm",
       "name": "eslint-plugin-react-hooks",
       "purl": "pkg:npm/eslint-plugin-react-hooks@5.2.0",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "5.2.0",
       "to": "7.1.1",
       "files": [
        "apps/viewer/package.json:37"
       ],
       "done_when": "the pin is on the newest major: 7.1.1"
      },
      {
       "ecosystem": "npm",
       "name": "globals",
       "purl": "pkg:npm/globals@14.0.0",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "14.0.0",
       "to": "17.12.0",
       "files": [
        "apps/viewer/package.json:38"
       ],
       "done_when": "the pin is on the newest major: 17.12.0"
      },
      {
       "ecosystem": "npm",
       "name": "jsdom",
       "purl": "pkg:npm/jsdom@25.0.1",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "25.0.1",
       "to": "30.1.1",
       "files": [
        "apps/viewer/package.json:39"
       ],
       "done_when": "the pin is on the newest major: 30.1.1"
      },
      {
       "ecosystem": "npm",
       "name": "typescript",
       "purl": "pkg:npm/typescript@5.9.3",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "5.9.3",
       "to": "7.0.2",
       "files": [
        "apps/viewer/package.json:41"
       ],
       "done_when": "the pin is on the newest major: 7.0.2"
      },
      {
       "ecosystem": "npm",
       "name": "vite",
       "purl": "pkg:npm/vite@6.4.3",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "6.4.3",
       "to": "8.3.1",
       "files": [
        "apps/viewer/package.json:43"
       ],
       "done_when": "the pin is on the newest major: 8.3.1"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-devtools-tracer-apps-viewer-package-json",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "@eslint/js",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "9.39.5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:dep:runtime-node",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade Node.js to 24.21.0 in tracer",
     "result": "Moves to the newest major",
     "steps": [
      {
       "edit": ".github/workflows/ci.yml",
       "line": 172,
       "text": "move to 24.21.0",
       "from": "22.13",
       "to": "24.21.0"
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "node",
       "label": "Node.js",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "22.13",
       "to": "24.21.0",
       "files": [
        ".github/workflows/ci.yml:172"
       ],
       "lifecycle": {
        "product": "nodejs",
        "cycle": "22",
        "eol": "2027-04-30",
        "phase": "maintenance",
        "url": "https://endoflife.date/nodejs"
       },
       "done_when": "the pin is on the newest major: 24.21.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-dep-runtime-node",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "node",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "22.13"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:dep:github-com-react-react",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade react to 19.3.0 in tracer",
     "result": "Moves 4 packages that release together",
     "steps": [
      {
       "run": "npm install react@19.3.0 react-dom@19.3.0 && npm install -D @types/react@19.3.0 @types/react-dom@19.3.0",
       "cwd": "apps/viewer"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@types/react",
       "purl": "pkg:npm/%40types/react@18.3.31",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "18.3.31",
       "to": "19.3.0",
       "files": [
        "apps/viewer/package.json:31"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "@types/react-dom",
       "purl": "pkg:npm/%40types/react-dom@18.3.7",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "18.3.7",
       "to": "19.3.0",
       "files": [
        "apps/viewer/package.json:32"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "react",
       "purl": "pkg:npm/react@18.3.1",
       "scope": "direct",
       "status": "major",
       "level": "warning",
       "from": "18.3.1",
       "to": "19.3.0",
       "files": [
        "apps/viewer/package.json:23"
       ],
       "lifecycle": {
        "product": "react",
        "cycle": "18",
        "eol": null,
        "phase": "maintenance",
        "url": "https://endoflife.date/react"
       },
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "react-dom",
       "purl": "pkg:npm/react-dom@18.3.1",
       "scope": "direct",
       "status": "major",
       "level": "warning",
       "from": "18.3.1",
       "to": "19.3.0",
       "files": [
        "apps/viewer/package.json:24"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-dep-github-com-react-react",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "@types/react",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "18.3.31"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:routine:runtime",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 1 toolchain in tracer",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go mod edit -modfile=go.golangci.mod -go=1.27.1",
       "cwd": "."
      },
      {
       "run": "go mod edit -go=1.27.1",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "go",
       "label": "Go toolchain",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.27.0",
       "to": "1.27.1",
       "files": [
        "go.golangci.mod:12",
        "go.mod:3"
       ],
       "lifecycle": {
        "product": "go",
        "cycle": "1.27",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/go"
       },
       "done_when": "the pin is 1.27.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-routine-runtime",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "go",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.27.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:routine:go",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 2 go modules in tracer",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go get -modfile=go.golangci.mod -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0",
       "cwd": "."
      },
      {
       "run": "go get -modfile=go.golangci.mod golang.org/x/tools@v0.50.0",
       "cwd": "."
      },
      {
       "run": "go get -tool golang.org/x/tools/cmd/deadcode@v0.50.0 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/golangci/golangci-lint/v2",
       "purl": "pkg:golang/github.com/golangci/golangci-lint/v2@v2.13.1",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v2.13.1",
       "to": "v2.14.0",
       "files": [
        "go.golangci.mod:99"
       ],
       "done_when": "the pin is v2.14.0 or newer"
      },
      {
       "ecosystem": "go",
       "name": "golang.org/x/tools",
       "purl": "pkg:golang/golang.org/x/tools@v0.49.0",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v0.49.0",
       "to": "v0.50.0",
       "files": [
        "go.golangci.mod:220",
        "go.mod:42"
       ],
       "done_when": "the pin is v0.50.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-routine-go",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "github.com/golangci/golangci-lint/v2",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v2.13.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:routine:npm",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 2 npm packages in tracer",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "npm install -D playwright-core@1.63.0",
       "cwd": "apps/viewer"
      },
      {
       "run": "npm install -D typescript-eslint@8.70.1",
       "cwd": "apps/viewer"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "playwright-core",
       "purl": "pkg:npm/playwright-core@1.62.1",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "1.62.1",
       "to": "1.63.0",
       "files": [
        "apps/viewer/package.json:40"
       ],
       "done_when": "the pin is 1.63.0 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "typescript-eslint",
       "purl": "pkg:npm/typescript-eslint@8.69.0",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "8.69.0",
       "to": "8.70.1",
       "files": [
        "apps/viewer/package.json:42"
       ],
       "done_when": "the pin is 8.70.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-routine-npm",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "playwright-core",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.62.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:sync:ui-npm-codesweep-ai-ui",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin @codesweep-ai/ui in tracer",
     "result": "Picks up up to 8 commits from ui",
     "steps": [
      {
       "run": "../../scripts/with-npmrevs.sh npm install --save-exact @codesweep-ai/ui@0.3.1-dev.20260924221206.9217a01",
       "cwd": "apps/viewer"
      },
      {
       "run": "make viewer-build",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@codesweep-ai/ui",
       "purl": "pkg:npm/%40codesweep-ai/ui@0.3.1-dev.20260924012330.d8a36fe",
       "scope": "direct",
       "status": "behind",
       "level": "info",
       "from": "0.3.1-dev.20260924012330.d8a36fe",
       "to": "0.3.1-dev.20260924221206.9217a01",
       "files": [
        "apps/viewer/package.json:21"
       ],
       "lag": {
        "commits": 8,
        "days": 0.9,
        "head": "9217a01ffda64d26d495486c4801d873799a254d",
        "pinned": "d8a36fe",
        "built": "9217a01ffda64d26d495486c4801d873799a254d",
        "version": "0.3.1-dev.20260924221206.9217a01"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-sync-ui-npm-codesweep-ai-ui",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "@codesweep-ai/ui",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "0.3.1-dev.20260924012330.d8a36fe"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:sync:ledger-go-github-com-codesweep-ai-ledger",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/ledger in tracer",
     "result": "Picks up up to 3 commits from ledger",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/ledger/cmd/cs-ledger@9c01ea57e8e2f26c9c48f9c315e25c604c085019 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/ledger",
       "purl": "pkg:golang/github.com/codesweep-ai/ledger@v0.0.0-20260924050924-dffe2aa34b39",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924050924-dffe2aa34b39",
       "to": "9c01ea5",
       "files": [
        "go.mod:16"
       ],
       "lag": {
        "commits": 3,
        "days": 0.7,
        "head": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "pinned": "dffe2aa34b39",
        "built": "9c01ea57e8e2f26c9c48f9c315e25c604c085019"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-sync-ledger-go-github-com-codesweep-ai-ledger",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "github.com/codesweep-ai/ledger",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924050924-dffe2aa34b39"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:sync:lint-go-github-com-codesweep-ai-lint",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/lint in tracer",
     "result": "Picks up up to 5 commits from lint",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/lint/cmd/cs-lint@341b79bde5204891a6e8074aa2a85e45bc009ecf && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/lint",
       "purl": "pkg:golang/github.com/codesweep-ai/lint@v0.0.0-20260924012322-5ffce6301cbf",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924012322-5ffce6301cbf",
       "to": "341b79b",
       "files": [
        "go.mod:17"
       ],
       "lag": {
        "commits": 5,
        "days": 0.9,
        "head": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "pinned": "5ffce6301cbf",
        "built": "341b79bde5204891a6e8074aa2a85e45bc009ecf"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-sync-lint-go-github-com-codesweep-ai-lint",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "github.com/codesweep-ai/lint",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924012322-5ffce6301cbf"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "tracer:sync:npmrevs-go-github-com-codesweep-ai-npmrevs",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/npmrevs in tracer",
     "result": "Picks up up to 4 commits from npmrevs",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/npmrevs/cmd/cs-npmrevs@6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/npmrevs",
       "purl": "pkg:golang/github.com/codesweep-ai/npmrevs@v0.0.0-20260924012324-0b587a7c4645",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924012324-0b587a7c4645",
       "to": "6bbb69b",
       "files": [
        "go.mod:18"
       ],
       "lag": {
        "commits": 4,
        "days": 0.9,
        "head": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504",
        "pinned": "0b587a7c4645",
        "built": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=tracer#action-sync-npmrevs-go-github-com-codesweep-ai-npmrevs",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "tracer",
       "name": "github.com/codesweep-ai/npmrevs",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924012324-0b587a7c4645"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  },
  {
   "name": "ui",
   "repo": {
    "url": "https://github.com/codesweep-ai/ui",
    "clone": "https://github.com/codesweep-ai/ui.git",
    "branch": "main",
    "sha": "9217a01ffda64d26d495486c4801d873799a254d"
   },
   "counts": {
    "fix": 5,
    "plan": 7,
    "routine": 4
   },
   "actions": [
    {
     "id": "ui:lock:ui-package-lock-json",
     "tier": "fix",
     "level": "serious",
     "type": "security",
     "title": "Refresh the lockfile in ui",
     "result": "Fixes 39 advisories",
     "why": "10 installed packages, worst critical, all dev only",
     "opened": "2026-06-15T17:15:07Z",
     "epss": 0.009,
     "steps": [
      {
       "run": "npm audit fix",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@vitest/browser",
       "purl": "pkg:npm/%40vitest/browser@4.1.7",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "4.1.7",
       "to": "4.1.10",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-g8mr-85jm-7xhm",
         "aliases": [
          "CVE-2026-53633"
         ],
         "severity": "critical",
         "summary": "Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE",
         "fixed": "4.1.8",
         "url": "https://osv.dev/vulnerability/GHSA-g8mr-85jm-7xhm",
         "epss": {
          "probability": 0.009,
          "percentile": 0.5779
         }
        },
        {
         "id": "GHSA-p63j-vcc4-9vmv",
         "aliases": [
          "CVE-2026-73653"
         ],
         "severity": "critical",
         "summary": "@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",
         "fixed": "4.1.10",
         "url": "https://osv.dev/vulnerability/GHSA-p63j-vcc4-9vmv",
         "epss": {
          "probability": 0.0079,
          "percentile": 0.5432
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of @vitest/browser that GHSA-g8mr-85jm-7xhm or GHSA-p63j-vcc4-9vmv affects"
      },
      {
       "ecosystem": "npm",
       "name": "@vitest/mocker",
       "purl": "pkg:npm/%40vitest/mocker@4.1.7",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "4.1.7",
       "to": "4.1.11",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-82fw-gwwq-j7x9",
         "aliases": [
          "CVE-2026-84373"
         ],
         "severity": "moderate",
         "summary": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
         "fixed": "4.1.11",
         "url": "https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9",
         "epss": {
          "probability": 0.0053,
          "percentile": 0.4215
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of @vitest/mocker that GHSA-82fw-gwwq-j7x9 affects"
      },
      {
       "ecosystem": "npm",
       "name": "baseline-browser-mapping",
       "purl": "pkg:npm/baseline-browser-mapping@2.10.32",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "2.10.32",
       "to": "2.11.0",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-w5vr-8v7q-w6rv",
         "aliases": [
          "CVE-2026-45819"
         ],
         "severity": "moderate",
         "summary": "baseline-browser-mapping process termination on invalid input causes denial of service",
         "fixed": "2.11.0",
         "url": "https://osv.dev/vulnerability/GHSA-w5vr-8v7q-w6rv",
         "epss": {
          "probability": 0.0051,
          "percentile": 0.4062
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of baseline-browser-mapping that GHSA-w5vr-8v7q-w6rv affects"
      },
      {
       "ecosystem": "npm",
       "name": "brace-expansion",
       "purl": "pkg:npm/brace-expansion@1.1.14",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "1.1.14",
       "to": "1.1.18",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-3jxr-9vmj-r5cp",
         "aliases": [
          "CVE-2026-13149"
         ],
         "severity": "high",
         "summary": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
         "fixed": "1.1.16",
         "url": "https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp",
         "epss": {
          "probability": 0.0036,
          "percentile": 0.2744
         }
        },
        {
         "id": "GHSA-mh99-v99m-4gvg",
         "aliases": [
          "CVE-2026-14257"
         ],
         "severity": "high",
         "summary": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
         "fixed": "1.1.17",
         "url": "https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg",
         "epss": {
          "probability": 0.0064,
          "percentile": 0.4855
         }
        },
        {
         "id": "GHSA-rgw5-rvv9-x895",
         "aliases": [
          "CVE-2026-69152"
         ],
         "severity": "high",
         "summary": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
         "fixed": "1.1.18",
         "url": "https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895",
         "epss": {
          "probability": 0.0075,
          "percentile": 0.5285
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of brace-expansion that GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg or GHSA-rgw5-rvv9-x895 affects"
      },
      {
       "ecosystem": "npm",
       "name": "brace-expansion",
       "purl": "pkg:npm/brace-expansion@5.0.6",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "5.0.6",
       "to": "5.0.9",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-3jxr-9vmj-r5cp",
         "aliases": [
          "CVE-2026-13149"
         ],
         "severity": "high",
         "summary": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
         "fixed": "5.0.7",
         "url": "https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp",
         "epss": {
          "probability": 0.0036,
          "percentile": 0.2744
         }
        },
        {
         "id": "GHSA-mh99-v99m-4gvg",
         "aliases": [
          "CVE-2026-14257"
         ],
         "severity": "high",
         "summary": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
         "fixed": "5.0.8",
         "url": "https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg",
         "epss": {
          "probability": 0.0064,
          "percentile": 0.4855
         }
        },
        {
         "id": "GHSA-rgw5-rvv9-x895",
         "aliases": [
          "CVE-2026-69152"
         ],
         "severity": "high",
         "summary": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
         "fixed": "5.0.9",
         "url": "https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895",
         "epss": {
          "probability": 0.0075,
          "percentile": 0.5285
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of brace-expansion that GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg or GHSA-rgw5-rvv9-x895 affects"
      },
      {
       "ecosystem": "npm",
       "name": "browserslist",
       "purl": "pkg:npm/browserslist@4.28.2",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "4.28.2",
       "to": "4.28.7",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-73wf-gq98-2v4g",
         "aliases": [
          "CVE-2026-73088"
         ],
         "severity": "high",
         "summary": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)",
         "fixed": "4.28.7",
         "url": "https://osv.dev/vulnerability/GHSA-73wf-gq98-2v4g",
         "epss": {
          "probability": 0.0066,
          "percentile": 0.4929
         }
        },
        {
         "id": "GHSA-c83g-rgw3-j3cx",
         "aliases": [
          "CVE-2026-73089"
         ],
         "severity": "high",
         "summary": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM",
         "fixed": "4.28.7",
         "url": "https://osv.dev/vulnerability/GHSA-c83g-rgw3-j3cx",
         "epss": {
          "probability": 0.0066,
          "percentile": 0.4917
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of browserslist that GHSA-73wf-gq98-2v4g or GHSA-c83g-rgw3-j3cx affects"
      },
      {
       "ecosystem": "npm",
       "name": "dompurify",
       "purl": "pkg:npm/dompurify@3.4.5",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "3.4.5",
       "to": "3.4.13",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-55q2-fjhq-7xh7",
         "aliases": [
          "CVE-2026-75838"
         ],
         "severity": "moderate",
         "summary": "DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS",
         "fixed": "3.4.13",
         "url": "https://osv.dev/vulnerability/GHSA-55q2-fjhq-7xh7",
         "epss": {
          "probability": 0.003,
          "percentile": 0.2018
         }
        },
        {
         "id": "GHSA-76mc-f452-cxcm",
         "aliases": [
          "CVE-2026-65902"
         ],
         "severity": "moderate",
         "summary": "DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",
         "fixed": "3.4.7",
         "url": "https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm",
         "epss": {
          "probability": 0.0036,
          "percentile": 0.265
         }
        },
        {
         "id": "GHSA-cmwh-pvxp-8882",
         "aliases": [
          "CVE-2026-65898"
         ],
         "severity": "moderate",
         "summary": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",
         "fixed": "3.4.11",
         "url": "https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882",
         "epss": {
          "probability": 0.003,
          "percentile": 0.2008
         }
        },
        {
         "id": "GHSA-hpcv-96wg-7vj8",
         "aliases": [
          "CVE-2026-49458"
         ],
         "severity": "moderate",
         "summary": "DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks",
         "fixed": "3.4.6",
         "url": "https://osv.dev/vulnerability/GHSA-hpcv-96wg-7vj8",
         "epss": {
          "probability": 0.004,
          "percentile": 0.3186
         }
        },
        {
         "id": "GHSA-r47g-fvhr-h676",
         "aliases": [
          "CVE-2026-49459"
         ],
         "severity": "moderate",
         "summary": "DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM",
         "fixed": "3.4.6",
         "url": "https://osv.dev/vulnerability/GHSA-r47g-fvhr-h676",
         "epss": {
          "probability": 0.0037,
          "percentile": 0.2753
         }
        },
        {
         "id": "GHSA-rp9w-3fw7-7cwq",
         "aliases": [
          "CVE-2026-49978"
         ],
         "severity": "moderate",
         "summary": "DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content",
         "fixed": "3.4.7",
         "url": "https://osv.dev/vulnerability/GHSA-rp9w-3fw7-7cwq",
         "epss": {
          "probability": 0.004,
          "percentile": 0.3186
         }
        },
        {
         "id": "GHSA-c2j3-45gr-mqc4",
         "aliases": [
          "CVE-2026-66010"
         ],
         "severity": "low",
         "summary": "DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",
         "fixed": "3.4.12",
         "url": "https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4",
         "epss": {
          "probability": 0.0031,
          "percentile": 0.2061
         }
        },
        {
         "id": "GHSA-gvmj-g25r-r7wr",
         "aliases": [
          "CVE-2026-65900"
         ],
         "severity": "low",
         "summary": "DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",
         "fixed": "3.4.8",
         "url": "https://osv.dev/vulnerability/GHSA-gvmj-g25r-r7wr",
         "epss": {
          "probability": 0.0031,
          "percentile": 0.2117
         }
        },
        {
         "id": "GHSA-vxr8-fq34-vvx9",
         "aliases": [
          "CVE-2026-65899"
         ],
         "severity": "low",
         "summary": "DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",
         "fixed": "3.4.9",
         "url": "https://osv.dev/vulnerability/GHSA-vxr8-fq34-vvx9",
         "epss": {
          "probability": 0.0041,
          "percentile": 0.3275
         }
        },
        {
         "id": "GHSA-x4vx-rjvf-j5p4",
         "aliases": [
          "CVE-2026-65901"
         ],
         "severity": "low",
         "summary": "DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",
         "url": "https://osv.dev/vulnerability/GHSA-x4vx-rjvf-j5p4",
         "epss": {
          "probability": 0.0029,
          "percentile": 0.1871
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of dompurify that GHSA-55q2-fjhq-7xh7, GHSA-76mc-f452-cxcm, GHSA-cmwh-pvxp-8882, GHSA-hpcv-96wg-7vj8, GHSA-r47g-fvhr-h676, GHSA-rp9w-3fw7-7cwq, GHSA-c2j3-45gr-mqc4, GHSA-gvmj-g25r-r7wr, GHSA-vxr8-fq34-vvx9 or GHSA-x4vx-rjvf-j5p4 affects"
      },
      {
       "ecosystem": "npm",
       "name": "fast-uri",
       "purl": "pkg:npm/fast-uri@3.1.5",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "3.1.5",
       "to": "3.1.6",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-5jgf-p345-68v8",
         "aliases": [
          "CVE-2026-75931"
         ],
         "severity": "high",
         "summary": "fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references",
         "fixed": "3.1.6",
         "url": "https://osv.dev/vulnerability/GHSA-5jgf-p345-68v8",
         "epss": {
          "probability": 0.004,
          "percentile": 0.3118
         }
        },
        {
         "id": "GHSA-f65p-4m7j-42xc",
         "aliases": [
          "CVE-2026-75975"
         ],
         "severity": "high",
         "summary": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",
         "fixed": "3.1.6",
         "url": "https://osv.dev/vulnerability/GHSA-f65p-4m7j-42xc",
         "epss": {
          "probability": 0.0038,
          "percentile": 0.2887
         }
        },
        {
         "id": "GHSA-fph4-wmhf-6fwf",
         "aliases": [
          "CVE-2026-75899"
         ],
         "severity": "high",
         "summary": "fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding",
         "fixed": "3.1.6",
         "url": "https://osv.dev/vulnerability/GHSA-fph4-wmhf-6fwf",
         "epss": {
          "probability": 0.0038,
          "percentile": 0.2887
         }
        },
        {
         "id": "GHSA-jqff-g426-hqxp",
         "aliases": [
          "CVE-2026-76172"
         ],
         "severity": "high",
         "summary": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization",
         "fixed": "3.1.6",
         "url": "https://osv.dev/vulnerability/GHSA-jqff-g426-hqxp",
         "epss": {
          "probability": 0.004,
          "percentile": 0.3118
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of fast-uri that GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf or GHSA-jqff-g426-hqxp affects"
      },
      {
       "ecosystem": "npm",
       "name": "js-yaml",
       "purl": "pkg:npm/js-yaml@4.1.1",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "4.1.1",
       "to": "4.3.2",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-2883-xcg3-v3hh",
         "aliases": [
          "CVE-2026-84375"
         ],
         "severity": "high",
         "summary": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
         "fixed": "4.3.2",
         "url": "https://osv.dev/vulnerability/GHSA-2883-xcg3-v3hh",
         "epss": {
          "probability": 0.0053,
          "percentile": 0.4223
         }
        },
        {
         "id": "GHSA-52cp-r559-cp3m",
         "aliases": [
          "CVE-2026-59869"
         ],
         "severity": "high",
         "summary": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
         "fixed": "4.3.0",
         "url": "https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m",
         "epss": {
          "probability": 0.0059,
          "percentile": 0.4561
         }
        },
        {
         "id": "GHSA-5p4m-2wfm-xmqj",
         "severity": "high",
         "summary": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported",
         "fixed": "4.3.1",
         "url": "https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj"
        },
        {
         "id": "GHSA-h67p-54hq-rp68",
         "aliases": [
          "CVE-2026-53550"
         ],
         "severity": "moderate",
         "summary": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
         "fixed": "4.2.0",
         "url": "https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68",
         "epss": {
          "probability": 0.0042,
          "percentile": 0.331
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of js-yaml that GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj or GHSA-h67p-54hq-rp68 affects"
      },
      {
       "ecosystem": "npm",
       "name": "undici",
       "purl": "pkg:npm/undici@7.25.0",
       "scope": "transitive",
       "dev": true,
       "status": "vulnerable",
       "level": "serious",
       "from": "7.25.0",
       "to": "7.29.0",
       "files": [
        "package-lock.json"
       ],
       "advisories": [
        {
         "id": "GHSA-4cwx-7wf7-3272",
         "aliases": [
          "CVE-2026-13697"
         ],
         "severity": "high",
         "summary": "undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives",
         "fixed": "7.29.0",
         "url": "https://osv.dev/vulnerability/GHSA-4cwx-7wf7-3272",
         "epss": {
          "probability": 0.0057,
          "percentile": 0.4472
         }
        },
        {
         "id": "GHSA-hm92-r4w5-c3mj",
         "aliases": [
          "CVE-2026-6734"
         ],
         "severity": "high",
         "summary": "undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse",
         "fixed": "7.28.0",
         "url": "https://osv.dev/vulnerability/GHSA-hm92-r4w5-c3mj",
         "epss": {
          "probability": 0.0039,
          "percentile": 0.2978
         }
        },
        {
         "id": "GHSA-vmh5-mc38-953g",
         "aliases": [
          "CVE-2026-9697"
         ],
         "severity": "high",
         "summary": "undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent",
         "fixed": "7.28.0",
         "url": "https://osv.dev/vulnerability/GHSA-vmh5-mc38-953g",
         "epss": {
          "probability": 0.0055,
          "percentile": 0.4382
         }
        },
        {
         "id": "GHSA-vxpw-j846-p89q",
         "aliases": [
          "CVE-2026-12151"
         ],
         "severity": "high",
         "summary": "undici WebSocket client vulnerable to denial of service via fragment count bypass",
         "fixed": "7.28.0",
         "url": "https://osv.dev/vulnerability/GHSA-vxpw-j846-p89q",
         "epss": {
          "probability": 0.0079,
          "percentile": 0.5428
         }
        },
        {
         "id": "GHSA-8xcm-r25x-g524",
         "aliases": [
          "CVE-2026-16728"
         ],
         "severity": "moderate",
         "summary": "undici vulnerable to downstream response desynchronization via retry interceptor",
         "fixed": "7.29.0",
         "url": "https://osv.dev/vulnerability/GHSA-8xcm-r25x-g524",
         "epss": {
          "probability": 0.0018,
          "percentile": 0.0635
         }
        },
        {
         "id": "GHSA-jr45-8vmc-qm54",
         "aliases": [
          "CVE-2026-14643"
         ],
         "severity": "moderate",
         "summary": "undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives",
         "fixed": "7.29.0",
         "url": "https://osv.dev/vulnerability/GHSA-jr45-8vmc-qm54",
         "epss": {
          "probability": 0.004,
          "percentile": 0.3094
         }
        },
        {
         "id": "GHSA-m8rv-5g2x-5cg5",
         "aliases": [
          "CVE-2026-15157"
         ],
         "severity": "moderate",
         "summary": "undici vulnerable to CRLF Injection via blob-like body 'type' property",
         "fixed": "7.29.0",
         "url": "https://osv.dev/vulnerability/GHSA-m8rv-5g2x-5cg5",
         "epss": {
          "probability": 0.0019,
          "percentile": 0.079
         }
        },
        {
         "id": "GHSA-p88m-4jfj-68fv",
         "aliases": [
          "CVE-2026-9679"
         ],
         "severity": "moderate",
         "summary": "undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",
         "fixed": "7.28.0",
         "url": "https://osv.dev/vulnerability/GHSA-p88m-4jfj-68fv",
         "epss": {
          "probability": 0.0033,
          "percentile": 0.2362
         }
        },
        {
         "id": "GHSA-pr7r-676h-xcf6",
         "aliases": [
          "CVE-2026-9678"
         ],
         "severity": "moderate",
         "summary": "undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",
         "fixed": "7.28.0",
         "url": "https://osv.dev/vulnerability/GHSA-pr7r-676h-xcf6",
         "epss": {
          "probability": 0.0042,
          "percentile": 0.3355
         }
        },
        {
         "id": "GHSA-v3r7-h72x-cjcm",
         "aliases": [
          "CVE-2026-16729"
         ],
         "severity": "moderate",
         "summary": "undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields",
         "fixed": "7.29.0",
         "url": "https://osv.dev/vulnerability/GHSA-v3r7-h72x-cjcm",
         "epss": {
          "probability": 0.0019,
          "percentile": 0.077
         }
        },
        {
         "id": "GHSA-35p6-xmwp-9g52",
         "aliases": [
          "CVE-2026-6733"
         ],
         "severity": "low",
         "summary": "undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse",
         "fixed": "7.28.0",
         "url": "https://osv.dev/vulnerability/GHSA-35p6-xmwp-9g52",
         "epss": {
          "probability": 0.0027,
          "percentile": 0.1709
         }
        },
        {
         "id": "GHSA-g8m3-5g58-fq7m",
         "aliases": [
          "CVE-2026-11525"
         ],
         "severity": "low",
         "summary": "undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",
         "fixed": "7.28.0",
         "url": "https://osv.dev/vulnerability/GHSA-g8m3-5g58-fq7m",
         "epss": {
          "probability": 0.0024,
          "percentile": 0.1322
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of undici that GHSA-4cwx-7wf7-3272, GHSA-hm92-r4w5-c3mj, GHSA-vmh5-mc38-953g, GHSA-vxpw-j846-p89q, GHSA-8xcm-r25x-g524, GHSA-jr45-8vmc-qm54, GHSA-m8rv-5g2x-5cg5, GHSA-p88m-4jfj-68fv, GHSA-pr7r-676h-xcf6, GHSA-v3r7-h72x-cjcm, GHSA-35p6-xmwp-9g52 or GHSA-g8m3-5g58-fq7m affects"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-lock-ui-package-lock-json",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "@vitest/browser",
       "finding": "GHSA-g8mr-85jm-7xhm",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "4.1.7"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:dep:github-com-mermaid-js-mermaid",
     "tier": "fix",
     "level": "serious",
     "type": "security",
     "title": "Upgrade mermaid to 11.16.1 in ui",
     "result": "Fixes 5 advisories",
     "opened": "2026-08-06T19:49:48Z",
     "epss": 0.006,
     "steps": [
      {
       "run": "npm install -D mermaid@11.16.1",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "mermaid",
       "purl": "pkg:npm/mermaid@11.15.0",
       "scope": "dev",
       "status": "vulnerable",
       "level": "serious",
       "from": "11.15.0",
       "to": "11.16.1",
       "files": [
        "package.json:222"
       ],
       "advisories": [
        {
         "id": "GHSA-2v8p-3f2j-5mp7",
         "aliases": [
          "CVE-2026-71436"
         ],
         "severity": "moderate",
         "summary": "Mermaid XY Charts are vulnerable to an infinite loop DoS",
         "fixed": "11.16.1",
         "url": "https://osv.dev/vulnerability/GHSA-2v8p-3f2j-5mp7",
         "epss": {
          "probability": 0.0058,
          "percentile": 0.4537
         }
        },
        {
         "id": "GHSA-3rrr-jr9j-h3q3",
         "aliases": [
          "CVE-2026-71437"
         ],
         "severity": "moderate",
         "summary": "Mermaid Architecture diagrams are vulnerable to prototype pollution",
         "fixed": "11.16.1",
         "url": "https://osv.dev/vulnerability/GHSA-3rrr-jr9j-h3q3",
         "epss": {
          "probability": 0.005,
          "percentile": 0.404
         }
        },
        {
         "id": "GHSA-6x64-9x62-f2gx",
         "aliases": [
          "CVE-2026-50159"
         ],
         "severity": "moderate",
         "summary": "Mermaid allows CSS injection applying to sibling elements of the diagram",
         "fixed": "11.16.1",
         "url": "https://osv.dev/vulnerability/GHSA-6x64-9x62-f2gx",
         "epss": {
          "probability": 0.006,
          "percentile": 0.4652
         }
        },
        {
         "id": "GHSA-rhh3-jpg6-66xh",
         "aliases": [
          "CVE-2026-71439"
         ],
         "severity": "moderate",
         "summary": "Mermaid radar diagrams are vulnerable to DoS",
         "fixed": "11.16.1",
         "url": "https://osv.dev/vulnerability/GHSA-rhh3-jpg6-66xh",
         "epss": {
          "probability": 0.0053,
          "percentile": 0.4218
         }
        },
        {
         "id": "GHSA-c4c3-pg64-4m4v",
         "aliases": [
          "CVE-2026-71438"
         ],
         "severity": "low",
         "summary": "Mermaid configuration APIs allow prototype pollution",
         "fixed": "11.16.1",
         "url": "https://osv.dev/vulnerability/GHSA-c4c3-pg64-4m4v",
         "epss": {
          "probability": 0.0035,
          "percentile": 0.2623
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of mermaid that GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx, GHSA-rhh3-jpg6-66xh or GHSA-c4c3-pg64-4m4v affects"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-dep-github-com-mermaid-js-mermaid",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "mermaid",
       "finding": "GHSA-2v8p-3f2j-5mp7",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "11.15.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:dep:github-com-vitejs-vite",
     "tier": "fix",
     "level": "serious",
     "type": "security",
     "title": "Upgrade vite to 8.0.16 in ui",
     "result": "Fixes 2 advisories",
     "opened": "2026-06-15T17:17:45Z",
     "epss": 0.0058,
     "steps": [
      {
       "run": "npm install -D vite@8.0.16",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "vite",
       "purl": "pkg:npm/vite@8.0.14",
       "scope": "dev",
       "status": "vulnerable",
       "level": "serious",
       "from": "8.0.14",
       "to": "8.0.16",
       "files": [
        "package.json:230"
       ],
       "advisories": [
        {
         "id": "GHSA-fx2h-pf6j-xcff",
         "aliases": [
          "CVE-2026-53571"
         ],
         "severity": "high",
         "summary": "vite: `server.fs.deny` bypass on Windows alternate paths",
         "fixed": "8.0.16",
         "url": "https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff",
         "epss": {
          "probability": 0.0058,
          "percentile": 0.4512
         }
        },
        {
         "id": "GHSA-v6wh-96g9-6wx3",
         "aliases": [
          "CVE-2026-53632"
         ],
         "severity": "moderate",
         "summary": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
         "fixed": "8.0.16",
         "url": "https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3",
         "epss": {
          "probability": 0.0041,
          "percentile": 0.3228
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of vite that GHSA-fx2h-pf6j-xcff or GHSA-v6wh-96g9-6wx3 affects"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-dep-github-com-vitejs-vite",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "vite",
       "finding": "GHSA-fx2h-pf6j-xcff",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "8.0.14"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:dep:github-com-vitest-dev-vitest",
     "tier": "fix",
     "level": "serious",
     "type": "security",
     "title": "Upgrade vitest to 4.1.11 in ui",
     "result": "Fixes 1 advisory",
     "opened": "2026-09-08T20:46:45Z",
     "epss": 0.0053,
     "steps": [
      {
       "run": "npm install -D vitest@4.1.11 @vitest/browser-playwright@4.1.11 @vitest/coverage-v8@4.1.11",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "vitest",
       "purl": "pkg:npm/vitest@4.1.7",
       "scope": "dev",
       "status": "vulnerable",
       "level": "serious",
       "from": "4.1.7",
       "to": "4.1.11",
       "files": [
        "package.json:232"
       ],
       "advisories": [
        {
         "id": "GHSA-82fw-gwwq-j7x9",
         "aliases": [
          "CVE-2026-84373"
         ],
         "severity": "moderate",
         "summary": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
         "fixed": "4.1.11",
         "url": "https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9",
         "epss": {
          "probability": 0.0053,
          "percentile": 0.4215
         }
        }
       ],
       "done_when": "package-lock.json carries no copy of vitest that GHSA-82fw-gwwq-j7x9 affects"
      },
      {
       "ecosystem": "npm",
       "name": "@vitest/browser-playwright",
       "purl": "pkg:npm/%40vitest/browser-playwright@4.1.7",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "4.1.7",
       "to": "4.1.11",
       "files": [
        "package.json:215"
       ],
       "done_when": "the pin is on the newest major: 4.1.11"
      },
      {
       "ecosystem": "npm",
       "name": "@vitest/coverage-v8",
       "purl": "pkg:npm/%40vitest/coverage-v8@4.1.7",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "4.1.7",
       "to": "4.1.11",
       "files": [
        "package.json:216"
       ],
       "done_when": "the pin is on the newest major: 4.1.11"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-dep-github-com-vitest-dev-vitest",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "vitest",
       "finding": "GHSA-82fw-gwwq-j7x9",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "4.1.7"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:eol:eslint-9",
     "tier": "fix",
     "level": "serious",
     "type": "eol",
     "title": "Move off ESLint 9 in ui",
     "result": "ESLint 9 ended 2026-08-06",
     "evidence": [
      "deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options."
     ],
     "opened": "2026-08-06T00:00:00Z",
     "steps": [
      {
       "run": "npm install -D eslint@10.11.0",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "eslint",
       "purl": "pkg:npm/eslint@9.39.4",
       "scope": "dev",
       "status": "eol",
       "level": "serious",
       "from": "9.39.4",
       "to": "10.11.0",
       "files": [
        "package.json:220"
       ],
       "lifecycle": {
        "product": "eslint",
        "cycle": "9",
        "eol": "2026-08-06",
        "phase": "eol",
        "url": "https://endoflife.date/eslint"
       },
       "done_when": "the pinned release line is supported past 90 days from now"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-eol-eslint-9",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "eslint",
       "finding": "eol",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "9.39.4"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 5 GitHub Actions in ui",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages, actions/upload-artifact show no repository activity in 90 days (OpenSSF Scorecard)"
     ],
     "steps": [
      {
       "edit": ".github/workflows/pages.yml",
       "line": 105,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 150,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 34,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 54,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 67,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 84,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 111,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 135,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 186,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 201,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 34,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 47,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 62,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 79,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ledger.yml",
       "line": 94,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/npm-images.yml",
       "line": 60,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/npm.yml",
       "line": 116,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 90,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/release.yml",
       "line": 61,
       "text": "uses: actions/setup-node@v7",
       "from": "v6",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 94,
       "text": "uses: actions/upload-artifact@v7",
       "from": "v4",
       "to": "v7"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 130,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/pages.yml:105"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:150"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/setup-node",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v6",
       "to": "7.0.0",
       "files": [
        ".github/workflows/ci.yml:34",
        ".github/workflows/ci.yml:54",
        ".github/workflows/ci.yml:67",
        ".github/workflows/ci.yml:84",
        ".github/workflows/ci.yml:111",
        ".github/workflows/ci.yml:135",
        ".github/workflows/ci.yml:186",
        ".github/workflows/ci.yml:201",
        ".github/workflows/ledger.yml:34",
        ".github/workflows/ledger.yml:47",
        ".github/workflows/ledger.yml:62",
        ".github/workflows/ledger.yml:79",
        ".github/workflows/ledger.yml:94",
        ".github/workflows/npm-images.yml:60",
        ".github/workflows/npm.yml:116",
        ".github/workflows/pages.yml:90",
        ".github/workflows/release.yml:61"
       ],
       "done_when": "the pin is on the newest major: 7.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "7.0.1",
       "files": [
        ".github/workflows/ci.yml:94"
       ],
       "done_when": "the pin is on the newest major: 7.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:130"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "actions/configure-pages",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:devtools:ui-package-json",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade 6 dev tools in ui",
     "result": "Moves 6 dev dependencies to their newest major",
     "why": "none of them ships",
     "steps": [
      {
       "run": "npm install -D @testing-library/jest-dom@7.0.1 @types/react@19.3.0 @types/react-dom@19.3.0 jsdom@30.1.1 pixelmatch@7.2.0 typescript@7.0.2",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@testing-library/jest-dom",
       "purl": "pkg:npm/%40testing-library/jest-dom@6.9.1",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "6.9.1",
       "to": "7.0.1",
       "files": [
        "package.json:204"
       ],
       "done_when": "the pin is on the newest major: 7.0.1"
      },
      {
       "ecosystem": "npm",
       "name": "@types/react",
       "purl": "pkg:npm/%40types/react@18.3.29",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "18.3.29",
       "to": "19.3.0",
       "files": [
        "package.json:211"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "@types/react-dom",
       "purl": "pkg:npm/%40types/react-dom@18.3.7",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "18.3.7",
       "to": "19.3.0",
       "files": [
        "package.json:212"
       ],
       "done_when": "the pin is on the newest major: 19.3.0"
      },
      {
       "ecosystem": "npm",
       "name": "jsdom",
       "purl": "pkg:npm/jsdom@29.1.1",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "29.1.1",
       "to": "30.1.1",
       "files": [
        "package.json:221"
       ],
       "done_when": "the pin is on the newest major: 30.1.1"
      },
      {
       "ecosystem": "npm",
       "name": "pixelmatch",
       "purl": "pkg:npm/pixelmatch@7.1.0",
       "scope": "dev",
       "status": "minor",
       "level": "warning",
       "from": "7.1.0",
       "to": "7.2.0",
       "files": [
        "package.json:223"
       ],
       "done_when": "the pin is 7.2.0 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "typescript",
       "purl": "pkg:npm/typescript@5.9.3",
       "scope": "dev",
       "status": "major",
       "level": "warning",
       "from": "5.9.3",
       "to": "7.0.2",
       "files": [
        "package.json:229"
       ],
       "done_when": "the pin is on the newest major: 7.0.2"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-devtools-ui-package-json",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "@testing-library/jest-dom",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "6.9.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:dep:github-com-lucide-icons-lucide",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade lucide-react to 1.48.0 in ui",
     "result": "Moves to the newest major",
     "steps": [
      {
       "run": "npm install lucide-react@1.48.0",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "lucide-react",
       "purl": "pkg:npm/lucide-react@0.563.0",
       "scope": "direct",
       "status": "major",
       "level": "warning",
       "from": "0.563.0",
       "to": "1.48.0",
       "files": [
        "package.json:189"
       ],
       "done_when": "the pin is on the newest major: 1.48.0"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-dep-github-com-lucide-icons-lucide",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "lucide-react",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "0.563.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:replace:d3-sankey",
     "tier": "plan",
     "level": "good",
     "type": "supply",
     "title": "Replace d3-sankey in ui",
     "result": "Moves off a package with no maintainer in sight",
     "why": "no release since 2019-09-02 and no repository activity in 90 days",
     "evidence": [
      "OpenSSF Scorecard fails Code-Review (overall 1.7/10)"
     ],
     "steps": [
      {
       "do": "find a maintained alternative, or vendor it and own it"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "d3-sankey",
       "purl": "pkg:npm/d3-sankey@0.12.3",
       "scope": "dev",
       "status": "current",
       "level": "good",
       "reason": "abandoned",
       "from": "0.12.3",
       "files": [
        "package.json:219"
       ],
       "signals": [
        {
         "kind": "abandoned",
         "text": "no release since 2019-09-02 and no repository activity in 90 days"
        },
        {
         "kind": "scorecard",
         "text": "OpenSSF Scorecard fails Code-Review (overall 1.7/10)"
        }
       ],
       "done_when": "the dependency is gone"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-replace-d3-sankey",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "d3-sankey",
       "finding": "current",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "0.12.3"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:replace:rehype-slug",
     "tier": "plan",
     "level": "good",
     "type": "supply",
     "title": "Replace rehype-slug in ui",
     "result": "Moves off a package with no maintainer in sight",
     "why": "no release since 2023-08-31 and no repository activity in 90 days",
     "evidence": [
      "OpenSSF Scorecard fails Code-Review (overall 3.1/10)"
     ],
     "steps": [
      {
       "do": "find a maintained alternative, or vendor it and own it"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "rehype-slug",
       "purl": "pkg:npm/rehype-slug@6.0.0",
       "scope": "direct",
       "status": "current",
       "level": "good",
       "reason": "abandoned",
       "from": "6.0.0",
       "files": [
        "package.json:193"
       ],
       "signals": [
        {
         "kind": "abandoned",
         "text": "no release since 2023-08-31 and no repository activity in 90 days"
        },
        {
         "kind": "scorecard",
         "text": "OpenSSF Scorecard fails Code-Review (overall 3.1/10)"
        }
       ],
       "done_when": "the dependency is gone"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-replace-rehype-slug",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "rehype-slug",
       "finding": "current",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "6.0.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:replace:roughjs",
     "tier": "plan",
     "level": "good",
     "type": "supply",
     "title": "Replace roughjs in ui",
     "result": "Moves off a package with no maintainer in sight",
     "why": "no release since 2023-11-20 and no repository activity in 90 days",
     "evidence": [
      "OpenSSF Scorecard fails Code-Review (overall 2/10)"
     ],
     "steps": [
      {
       "do": "find a maintained alternative, or vendor it and own it"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "roughjs",
       "purl": "pkg:npm/roughjs@4.6.6",
       "scope": "direct",
       "status": "current",
       "level": "good",
       "reason": "abandoned",
       "from": "4.6.6",
       "files": [
        "package.json:196"
       ],
       "signals": [
        {
         "kind": "abandoned",
         "text": "no release since 2023-11-20 and no repository activity in 90 days"
        },
        {
         "kind": "scorecard",
         "text": "OpenSSF Scorecard fails Code-Review (overall 2/10)"
        }
       ],
       "done_when": "the dependency is gone"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-replace-roughjs",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "roughjs",
       "finding": "current",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "4.6.6"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:replace:unified",
     "tier": "plan",
     "level": "good",
     "type": "supply",
     "title": "Replace unified in ui",
     "result": "Moves off a package with no maintainer in sight",
     "why": "no release since 2024-06-19 and no repository activity in 90 days",
     "steps": [
      {
       "do": "find a maintained alternative, or vendor it and own it"
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "unified",
       "purl": "pkg:npm/unified@11.0.5",
       "scope": "direct",
       "status": "current",
       "level": "good",
       "reason": "abandoned",
       "from": "11.0.5",
       "files": [
        "package.json:197"
       ],
       "signals": [
        {
         "kind": "abandoned",
         "text": "no release since 2024-06-19 and no repository activity in 90 days"
        }
       ],
       "done_when": "the dependency is gone"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-replace-unified",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "unified",
       "finding": "current",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "11.0.5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:routine:npm",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 12 npm packages in ui",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "evidence": [
      "its files also carry CC-BY-SA-4.0, Vim, OSL-3.0",
      "@testing-library/react has no repository activity in 90 days (OpenSSF Scorecard)",
      "katex: OpenSSF Scorecard fails Dangerous-Workflow (overall 4.5/10)",
      "puppeteer runs a script when npm installs it"
     ],
     "steps": [
      {
       "run": "npm install -D @testing-library/react@16.3.3",
       "cwd": "."
      },
      {
       "run": "npm install -D @testing-library/user-event@14.6.7",
       "cwd": "."
      },
      {
       "run": "npm install -D @types/node@26.6.2",
       "cwd": "."
      },
      {
       "run": "npm install -D @typescript-eslint/parser@8.70.1",
       "cwd": "."
      },
      {
       "run": "npm install -D @vitejs/plugin-react@6.1.1",
       "cwd": "."
      },
      {
       "run": "npm install -D autoprefixer@10.6.1",
       "cwd": "."
      },
      {
       "run": "npm install highlight.js@11.12.0",
       "cwd": "."
      },
      {
       "run": "npm install katex@0.18.9",
       "cwd": "."
      },
      {
       "run": "npm install -D postcss@8.5.28",
       "cwd": "."
      },
      {
       "run": "npm install -D puppeteer@25.12.0",
       "cwd": "."
      },
      {
       "run": "npm install -D recharts@3.10.1",
       "cwd": "."
      },
      {
       "run": "npm install -D stylelint@17.15.0",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@testing-library/react",
       "purl": "pkg:npm/%40testing-library/react@16.3.2",
       "scope": "dev",
       "status": "patch",
       "level": "info",
       "from": "16.3.2",
       "to": "16.3.3",
       "files": [
        "package.json:205"
       ],
       "done_when": "the pin is 16.3.3 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "@testing-library/user-event",
       "purl": "pkg:npm/%40testing-library/user-event@14.6.1",
       "scope": "dev",
       "status": "patch",
       "level": "info",
       "from": "14.6.1",
       "to": "14.6.7",
       "files": [
        "package.json:206"
       ],
       "done_when": "the pin is 14.6.7 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "@types/node",
       "purl": "pkg:npm/%40types/node@26.2.0",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "26.2.0",
       "to": "26.6.2",
       "files": [
        "package.json:209"
       ],
       "done_when": "the pin is 26.6.2 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "@typescript-eslint/parser",
       "purl": "pkg:npm/%40typescript-eslint/parser@8.59.4",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "8.59.4",
       "to": "8.70.1",
       "files": [
        "package.json:213"
       ],
       "done_when": "the pin is 8.70.1 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "@vitejs/plugin-react",
       "purl": "pkg:npm/%40vitejs/plugin-react@6.0.2",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "6.0.2",
       "to": "6.1.1",
       "files": [
        "package.json:214"
       ],
       "done_when": "the pin is 6.1.1 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "autoprefixer",
       "purl": "pkg:npm/autoprefixer@10.5.0",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "10.5.0",
       "to": "10.6.1",
       "files": [
        "package.json:217"
       ],
       "done_when": "the pin is 10.6.1 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "highlight.js",
       "purl": "pkg:npm/highlight.js@11.11.1",
       "scope": "direct",
       "status": "minor",
       "level": "info",
       "from": "11.11.1",
       "to": "11.12.0",
       "files": [
        "package.json:187"
       ],
       "done_when": "the pin is 11.12.0 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "katex",
       "purl": "pkg:npm/katex@0.16.47",
       "scope": "direct",
       "status": "minor",
       "level": "info",
       "from": "0.16.47",
       "to": "0.18.9",
       "files": [
        "package.json:188"
       ],
       "done_when": "the pin is 0.18.9 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "postcss",
       "purl": "pkg:npm/postcss@8.5.26",
       "scope": "dev",
       "status": "patch",
       "level": "info",
       "from": "8.5.26",
       "to": "8.5.28",
       "files": [
        "package.json:225"
       ],
       "done_when": "the pin is 8.5.28 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "puppeteer",
       "purl": "pkg:npm/puppeteer@25.1.0",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "25.1.0",
       "to": "25.12.0",
       "files": [
        "package.json:226"
       ],
       "done_when": "the pin is 25.12.0 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "recharts",
       "purl": "pkg:npm/recharts@3.8.1",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "3.8.1",
       "to": "3.10.1",
       "files": [
        "package.json:227"
       ],
       "done_when": "the pin is 3.10.1 or newer"
      },
      {
       "ecosystem": "npm",
       "name": "stylelint",
       "purl": "pkg:npm/stylelint@17.14.1",
       "scope": "dev",
       "status": "minor",
       "level": "info",
       "from": "17.14.1",
       "to": "17.15.0",
       "files": [
        "package.json:228"
       ],
       "done_when": "the pin is 17.15.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-routine-npm",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "@testing-library/react",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "16.3.2"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:sync:ledger-npm-codesweep-ai-ledger",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin @codesweep-ai/ledger in ui",
     "result": "Picks up up to 3 commits from ledger",
     "steps": [
      {
       "run": "scripts/with-npmrevs.sh npm install --save-exact -D @codesweep-ai/ledger@0.0.0-20260924221205-9c01ea57e8e2",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@codesweep-ai/ledger",
       "purl": "pkg:npm/%40codesweep-ai/ledger@0.0.0-20260924050924-dffe2aa34b39",
       "scope": "dev",
       "status": "behind",
       "level": "info",
       "from": "0.0.0-20260924050924-dffe2aa34b39",
       "to": "0.0.0-20260924221205-9c01ea57e8e2",
       "files": [
        "package.json:201"
       ],
       "lag": {
        "commits": 3,
        "days": 0.7,
        "head": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "pinned": "dffe2aa34b39",
        "built": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "version": "0.0.0-20260924221205-9c01ea57e8e2"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-sync-ledger-npm-codesweep-ai-ledger",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "@codesweep-ai/ledger",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "0.0.0-20260924050924-dffe2aa34b39"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:sync:lint-npm-codesweep-ai-lint",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin @codesweep-ai/lint in ui",
     "result": "Picks up up to 5 commits from lint",
     "steps": [
      {
       "run": "scripts/with-npmrevs.sh npm install --save-exact -D @codesweep-ai/lint@0.0.0-20260924221206-341b79bde520",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@codesweep-ai/lint",
       "purl": "pkg:npm/%40codesweep-ai/lint@0.0.0-20260924012322-5ffce6301cbf",
       "scope": "dev",
       "status": "behind",
       "level": "info",
       "from": "0.0.0-20260924012322-5ffce6301cbf",
       "to": "0.0.0-20260924221206-341b79bde520",
       "files": [
        "package.json:202"
       ],
       "lag": {
        "commits": 5,
        "days": 0.9,
        "head": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "pinned": "5ffce6301cbf",
        "built": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "version": "0.0.0-20260924221206-341b79bde520"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-sync-lint-npm-codesweep-ai-lint",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "@codesweep-ai/lint",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "0.0.0-20260924012322-5ffce6301cbf"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "ui:sync:npmrevs-npm-codesweep-ai-npmrevs",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin @codesweep-ai/npmrevs in ui",
     "result": "Picks up up to 4 commits from npmrevs",
     "steps": [
      {
       "run": "scripts/with-npmrevs.sh npm install --save-exact -D @codesweep-ai/npmrevs@0.0.0-20260924221206-6bbb69bc9a58",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "npm",
       "name": "@codesweep-ai/npmrevs",
       "purl": "pkg:npm/%40codesweep-ai/npmrevs@0.0.0-20260924012324-0b587a7c4645",
       "scope": "dev",
       "status": "behind",
       "level": "info",
       "from": "0.0.0-20260924012324-0b587a7c4645",
       "to": "0.0.0-20260924221206-6bbb69bc9a58",
       "files": [
        "package.json:203"
       ],
       "lag": {
        "commits": 4,
        "days": 0.9,
        "head": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504",
        "pinned": "0b587a7c4645",
        "built": "6bbb69bc9a58949e5bcc0e8293ee5d01ee99a504",
        "version": "0.0.0-20260924221206-6bbb69bc9a58"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=ui#action-sync-npmrevs-npm-codesweep-ai-npmrevs",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "ui",
       "name": "@codesweep-ai/npmrevs",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "0.0.0-20260924012324-0b587a7c4645"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  },
  {
   "name": "vcr",
   "repo": {
    "url": "https://github.com/codesweep-ai/vcr",
    "clone": "https://github.com/codesweep-ai/vcr.git",
    "branch": "main",
    "sha": "85d428f1ef67c1fed364ad699a0b943c664771b9"
   },
   "counts": {
    "fix": 0,
    "plan": 2,
    "routine": 4
   },
   "actions": [
    {
     "id": "vcr:actions:actions",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Update 5 GitHub Actions in vcr",
     "result": "One commit per project moves every uses: line",
     "evidence": [
      "actions/configure-pages, actions/download-artifact show no repository activity in 90 days (OpenSSF Scorecard)",
      "sigstore/cosign-installer is a third-party action pinned by a tag its owner can move"
     ],
     "steps": [
      {
       "edit": ".github/workflows/pages.yml",
       "line": 94,
       "text": "uses: actions/configure-pages@v6",
       "from": "v5",
       "to": "v6"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 125,
       "text": "uses: actions/deploy-pages@v5",
       "from": "v4",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/ci.yml",
       "line": 302,
       "text": "uses: actions/download-artifact@v8",
       "from": "v7",
       "to": "v8"
      },
      {
       "edit": ".github/workflows/pages.yml",
       "line": 109,
       "text": "uses: actions/upload-pages-artifact@v5",
       "from": "v3",
       "to": "v5"
      },
      {
       "edit": ".github/workflows/release.yml",
       "line": 28,
       "text": "uses: sigstore/cosign-installer@v4",
       "from": "v3",
       "to": "v4"
      }
     ],
     "changes": [
      {
       "ecosystem": "actions",
       "name": "actions/configure-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v5",
       "to": "6.0.0",
       "files": [
        ".github/workflows/pages.yml:94"
       ],
       "done_when": "the pin is on the newest major: 6.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "actions/deploy-pages",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v4",
       "to": "5.0.1",
       "files": [
        ".github/workflows/pages.yml:125"
       ],
       "done_when": "the pin is on the newest major: 5.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/download-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v7",
       "to": "8.0.1",
       "files": [
        ".github/workflows/ci.yml:302"
       ],
       "done_when": "the pin is on the newest major: 8.0.1"
      },
      {
       "ecosystem": "actions",
       "name": "actions/upload-pages-artifact",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "5.0.0",
       "files": [
        ".github/workflows/pages.yml:109"
       ],
       "done_when": "the pin is on the newest major: 5.0.0"
      },
      {
       "ecosystem": "actions",
       "name": "sigstore/cosign-installer",
       "scope": "ci",
       "status": "major",
       "level": "warning",
       "from": "v3",
       "to": "4.1.2",
       "files": [
        ".github/workflows/release.yml:28"
       ],
       "done_when": "the pin is on the newest major: 4.1.2"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=vcr#action-actions",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "vcr",
       "name": "actions/configure-pages",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v5"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "vcr:dep:image-registry-fedoraproject-org-fedora-minimal",
     "tier": "plan",
     "level": "warning",
     "type": "update",
     "title": "Upgrade registry.fedoraproject.org/fedora-minimal to 46 in vcr",
     "result": "Moves to the newest major",
     "steps": [
      {
       "edit": "deploy/vcr.yaml",
       "line": 44,
       "text": "move to 46",
       "from": "44",
       "to": "46"
      }
     ],
     "changes": [
      {
       "ecosystem": "image",
       "name": "registry.fedoraproject.org/fedora-minimal",
       "purl": "pkg:docker/fedora-minimal@44?repository_url=registry.fedoraproject.org",
       "scope": "deploy",
       "status": "major",
       "level": "warning",
       "from": "44",
       "to": "46",
       "files": [
        "deploy/vcr.yaml:44"
       ],
       "done_when": "the pin is on the newest major: 46"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=vcr#action-dep-image-registry-fedoraproject-org-fedora-minimal",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "vcr",
       "name": "registry.fedoraproject.org/fedora-minimal",
       "finding": "major",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "44"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "vcr:routine:runtime",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 1 toolchain in vcr",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go mod edit -modfile=go.golangci.mod -go=1.27.1",
       "cwd": "."
      },
      {
       "run": "go mod edit -go=1.27.1",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "runtime",
       "name": "go",
       "label": "Go toolchain",
       "scope": "build",
       "status": "patch",
       "level": "info",
       "from": "1.27.0",
       "to": "1.27.1",
       "files": [
        "go.golangci.mod:12",
        "go.mod:3"
       ],
       "lifecycle": {
        "product": "go",
        "cycle": "1.27",
        "eol": null,
        "phase": "active",
        "url": "https://endoflife.date/go"
       },
       "done_when": "the pin is 1.27.1 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=vcr#action-routine-runtime",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "vcr",
       "name": "go",
       "finding": "patch",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "1.27.0"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "vcr:routine:go",
     "tier": "routine",
     "level": "info",
     "type": "update",
     "title": "Bump 2 go modules in vcr",
     "result": "Newer minor and patch releases",
     "why": "none of them urgent",
     "steps": [
      {
       "run": "go get -modfile=go.golangci.mod -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0",
       "cwd": "."
      },
      {
       "run": "go get -modfile=go.golangci.mod golang.org/x/tools@v0.50.0",
       "cwd": "."
      },
      {
       "run": "go get -tool golang.org/x/tools/cmd/deadcode@v0.50.0 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/golangci/golangci-lint/v2",
       "purl": "pkg:golang/github.com/golangci/golangci-lint/v2@v2.13.1",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v2.13.1",
       "to": "v2.14.0",
       "files": [
        "go.golangci.mod:99"
       ],
       "done_when": "the pin is v2.14.0 or newer"
      },
      {
       "ecosystem": "go",
       "name": "golang.org/x/tools",
       "purl": "pkg:golang/golang.org/x/tools@v0.49.0",
       "scope": "tool",
       "status": "minor",
       "level": "info",
       "from": "v0.49.0",
       "to": "v0.50.0",
       "files": [
        "go.golangci.mod:220",
        "go.mod:29"
       ],
       "done_when": "the pin is v0.50.0 or newer"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=vcr#action-routine-go",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "vcr",
       "name": "github.com/golangci/golangci-lint/v2",
       "finding": "minor",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v2.13.1"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "vcr:sync:ledger-go-github-com-codesweep-ai-ledger",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/ledger in vcr",
     "result": "Picks up up to 3 commits from ledger",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/ledger/cmd/cs-ledger@9c01ea57e8e2f26c9c48f9c315e25c604c085019 && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/ledger",
       "purl": "pkg:golang/github.com/codesweep-ai/ledger@v0.0.0-20260924050924-dffe2aa34b39",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924050924-dffe2aa34b39",
       "to": "9c01ea5",
       "files": [
        "go.mod:13"
       ],
       "lag": {
        "commits": 3,
        "days": 0.7,
        "head": "9c01ea57e8e2f26c9c48f9c315e25c604c085019",
        "pinned": "dffe2aa34b39",
        "built": "9c01ea57e8e2f26c9c48f9c315e25c604c085019"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=vcr#action-sync-ledger-go-github-com-codesweep-ai-ledger",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "vcr",
       "name": "github.com/codesweep-ai/ledger",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924050924-dffe2aa34b39"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    },
    {
     "id": "vcr:sync:lint-go-github-com-codesweep-ai-lint",
     "tier": "routine",
     "level": "info",
     "type": "sync",
     "title": "Repin github.com/codesweep-ai/lint in vcr",
     "result": "Picks up up to 5 commits from lint",
     "steps": [
      {
       "run": "go get -tool github.com/codesweep-ai/lint/cmd/cs-lint@341b79bde5204891a6e8074aa2a85e45bc009ecf && go mod tidy",
       "cwd": "."
      }
     ],
     "changes": [
      {
       "ecosystem": "go",
       "name": "github.com/codesweep-ai/lint",
       "purl": "pkg:golang/github.com/codesweep-ai/lint@v0.0.0-20260924012322-5ffce6301cbf",
       "scope": "tool",
       "status": "behind",
       "level": "info",
       "from": "v0.0.0-20260924012322-5ffce6301cbf",
       "to": "341b79b",
       "files": [
        "go.mod:14"
       ],
       "lag": {
        "commits": 5,
        "days": 0.9,
        "head": "341b79bde5204891a6e8074aa2a85e45bc009ecf",
        "pinned": "5ffce6301cbf",
        "built": "341b79bde5204891a6e8074aa2a85e45bc009ecf"
       },
       "done_when": "the pin names the newest commit or build"
      }
     ],
     "page": "https://codesweep.ai/dashboards/deps?project=vcr#action-sync-lint-go-github-com-codesweep-ai-lint",
     "decline": {
      "file": "deps-config.json",
      "repo": "codesweep-ai/dashboards",
      "accepted": {
       "project": "vcr",
       "name": "github.com/codesweep-ai/lint",
       "finding": "behind",
       "reason": "tolerable_risk",
       "note": "why this is left as it is",
       "until": "YYYY-MM-DD",
       "version": "v0.0.0-20260924012322-5ffce6301cbf"
      },
      "reasons": [
       "fix_started",
       "inaccurate",
       "no_bandwidth",
       "not_used",
       "tolerable_risk"
      ]
     }
    }
   ]
  }
 ]
}