[Dependencies] Weekly Report — 2026-03-09

[github-actions]

[Dependencies] Weekly Report — 2026-03-09

Scanned: 22 repositories | Run: 22848481544

Summary

Metric	Count
Repos scanned	22
Total pending dependency PRs	10
Security / Critical	0
Major updates	5
Minor updates	1
Patch updates	4
PRs with failing CI	3
Aging PRs (> 7 days)	1

Security Updates (Action Required)

No security updates detected.

Major Updates

5 major version updates

Repo	PR	Dependency	From	To	Age	CI
atlatl	#73	docker/build-push-action	6.19.2	7.0.0	7d ⚠️	unknown
atlatl	#84	rmcp	0.17.0	1.1.0	0d	unknown
atlatl	#91	docker/build-push-action	6.19.2	7.0.0	0d	❌ fail
atlatl	#92	docker/metadata-action	5.10.0	6.0.0	0d	❌ fail
lro-bench	#23	docker/build-push-action	6.19.2	7.0.0	0d	❌ fail

Minor Updates

1 minor version update

Repo	PR	Dependency	From	To	Age	CI
adrscope	#47	github/gh-aw	0.51.4	0.56.2	0d	pending

Patch Updates

4 patch version updates

Repo	PR	Dependency	From	To	Age	CI
adrscope	#48	taiki-e/install-action	2.68.15	2.68.25	0d	pending
daedalus	#15	zircote/adrscope	71c2db3	15b8b26	6d	✅ pass
atlatl-spec	#187	@redocly/cli	2.20.0	2.20.4	0d	unknown
atlatl-spec	#188	@astrojs/starlight	0.37.6	0.37.7	0d	unknown

Attention Required

Failing CI (mergeable_state: unstable):

• atlatl #91: ci: bump docker/build-push-action from 6.19.2 to 7.0.0 — CI checks unstable
• atlatl #92: ci: bump docker/metadata-action from 5.10.0 to 6.0.0 — CI checks unstable
• lro-bench #23: ci: bump docker/build-push-action from 6.19.2 to 7.0.0 — CI checks unstable

Aging PRs (> 7 days):

• atlatl #73: ci: bump docker/build-push-action from 6.19.2 to 7.0.0 — open for 7 days (created 2026-03-02)

Note: Three repos (atlatl, lro-bench, atlatl-spec) have Dependabot configured but CI status checks return 403 (private repo access restriction). Mergeable state is used as CI proxy for those repos.

Clean Repositories

17 repositories with no pending dependency updates

.github, github-project-manager, sdlc-quality, homebrew-tap, rlm-rs, MIF, subcog, ccpkg, refactor, human-voice, rlm-rs-plugin, memory-capture-plugin, documentation-review, adr, git-adr, structured-madr, vscode-git-adr

---

Scope note: The org-wide Dependabot search (org:zircote) found 16 open PRs in total; 10 belong to managed repos (per gpm-config.yml). The remaining 6 are in unmanaged repos not covered by this report.

Generated by housekeeping-deps workflow — https://github.com/zircote/.github/actions/runs/22848481544

Generated by Housekeeping: Dependency Updates