Daily Autohealing Report — 2026-03-20 (UTC)

[fro-bot]

Daily Autohealing Report — 2026-03-20 (UTC)

Errored PRs

PR	Failure	Fix	Status
None	-	-	✅ All clear

Security

Advisory / PR	Severity	Action Taken
GHSA-rf6f-7fwh-wjgh	High	✅ PR #2909 created — bump flatted to 3.4.2

Code Quality & Repo Hygiene

Check	Result	Action
Build	✅ All packages pass	All 11 packages build successfully
Type coverage	✅ Meets thresholds	0/0 (root tsconfig has no files — packages use individual tsconfigs; pre-existing)
Stale TODOs	3 found	Pre-existing from 2026-03-18: workflow-manager.ts lines 687/719 (2025-08-25) and prettier.ts line 102 (2024-12-29). Scope cap: requires judgment on whether to implement or remove.
Convention drift	✅ Clean	Pre-existing export * in barrel index.ts files, test fixtures with any types — all intentional
AGENTS.md accuracy	✅ Current	All 9 packages and commands verified
Workspace analysis	⚠️ 67 issues (13 errors, 54 warnings)	Pre-existing: workspace protocol reference errors, version conflicts in eslint-config dependencies. Build/lint/test all pass.

Developer Experience

• ✅ pnpm build passes (all packages)
• ✅ pnpm lint passes
• ✅ pnpm type-check passes
• ✅ pnpm test passes (146 files, 3383 tests)
• ⚠️ pnpm analyze command broken: pnpm workspace-analyzer fails because the CLI is not linked as a workspace command. Workaround: node packages/workspace-analyzer/lib/cli.js --json works correctly. Pre-existing.

Needs Human Attention

• Workspace analyzer pnpm analyze command broken: pnpm workspace-analyzer fails because the CLI is not registered as a workspace command at the root. The bin entry exists in packages/workspace-analyzer/package.json but pnpm does not expose it as a workspace command. Workaround: node packages/workspace-analyzer/lib/cli.js --json. The analyzer itself works correctly.
• Stale TODOs (>90 days): 3 TODOs in source files older than 90 days (workflow-manager.ts lines 687/719 from 2025-08-25, prettier.ts line 102 from 2024-12-29). Not auto-fixed due to scope cap — requires judgment on whether to implement or remove.
• Workspace analyzer structural issues: 13 errors include invalid workspace protocol references and invalid peer version ranges in eslint-config. Pre-existing; all CI checks pass.

[fro-bot]

Daily Autohealing Run — 2026-03-20 (UTC) Complete

Actions Taken

Category 2 — Security (1 fix pushed):

• Discovered 1 open high-severity Dependabot alert: GHSA-rf6f-7fwh-wjgh (Prototype Pollution in flatted, CVSS 4.0: 8.9)
• flatted@3.4.1 is a transitive dependency via eslint@10.0.3 → file-entry-cache@8.0.0 → flat-cache@4.0.1 → flatted@3.4.1
• Created PR fix(deps): bump flatted to 3.4.2 to patch GHSA-rf6f-7fwh-wjgh #2909: added flatted@3.4.2 as a direct devDependency, forcing pnpm to hoist the patched version
• Vulnerability verified patched: parse('[{\"x\":\"__proto__\"}]').x is now undefined (safe) instead of Array.prototype (vulnerable)
• Full validation passed: build ✅, type-check ✅, lint ✅, 3383 tests ✅

Category 3 — Code Quality (report-only checks):

• Build: ✅ All 11 packages pass
• Type-check: ✅ No errors
• Lint: ✅ No errors
• Tests: ✅ 146 files, 3383 tests pass
• Type coverage: 0/0 (pre-existing — root tsconfig has no files; packages checked individually)
• Stale TODOs: 3 pre-existing (>90 days), scope-capped
• Convention drift: ✅ Clean
• AGENTS.md: ✅ Current
• Workspace analysis: ⚠️ 67 issues (13 errors, 54 warnings) — pre-existing

Category 4 — Developer Experience:

• No lint/type-check/build failures to fix
• ⚠️ pnpm analyze command broken (pre-existing): pnpm workspace-analyzer fails because CLI not linked as workspace command

Deliverables

• Issue Daily Autohealing Report — 2026-03-20 (UTC) #2910: Daily Autohealing Report — 2026-03-20 (UTC)
• PR fix(deps): bump flatted to 3.4.2 to patch GHSA-rf6f-7fwh-wjgh #2909: fix(deps): bump flatted to 3.4.2 to patch GHSA-rf6f-7fwh-wjgh

Needs Human Attention

• pnpm analyze command broken (pre-existing)
• 3 stale TODOs in source files >90 days old
• 13 workspace analyzer structural errors (pre-existing)

---

Run Summary

Field	Value
Event	schedule
Repository	bfra-me/works
Run ID	23329790961
Cache	hit
Session	ses_2f6610870ffepgs4xS3QeDI5io