Daily Org Oversight Report — 2026-03-28 (UTC)

[fro-bot]

Summary Metrics

Metric	Count
New Issues (24h)	2
Open PRs	5
Stale Issues (>30 days)	0
Stale PRs (>14 days)	0
Failing Main Checks	0
Security Alerts	15 (1 critical, 7 high, 7 medium)

Critical Items

🔴 Security Alerts — fro-bot/agent (7 open alerts)

CRITICAL:

• CVE-2026-33937 — Handlebars.js AST Type Confusion RCE (CVSS 9.8)
  • Action: Update handlebars to v4.7.9 immediately

HIGH (5 alerts):

• CVE-2026-33941, CVE-2026-33940, CVE-2026-33939, CVE-2026-33938 in handlebars — Update to v4.7.9
• View all handlebars alerts

MEDIUM:

• CVE-2026-33750 in brace-expansion (2 alerts) — DoS via zero-step sequence
• CVE-2026-33672, CVE-2026-33671 in picomatch (2 alerts) — ReDoS and method injection

🟡 Security Alerts — fro-bot/.github (3 open alerts)

• 1 HIGH, 2 MEDIUM severity alerts
• View alerts

Recommended Action: Run pnpm update or let Renovate merge pending dependency updates to resolve most alerts.

Aging PRs (< 14 days, no activity > 7 days)

None. All open PRs have recent activity:

• agent#388 — ci(deps): update github/codeql-action (1 day old)
• agent#385 — chore(dev): update vitest (2 days old)
• agent#382 — chore(dev): update @vitest/eslint-plugin (3 days old)
• .github#3028 — chore(deps): update pnpm (1 day old)
• .github#3025 — fix(security): update picomatch (1 day old)

Stale Issues (> 30 days)

None. All issues have activity within the last 30 days:

• systematic#1 — Enable code scanning (19 days old)
• fro-bot.github.io#1 — Enable code scanning (19 days old)

Unassigned Bugs/High-Signal Issues

No open issues with bug label found across all repositories.

Repo Hotspots (by open PRs and stale items)

Rank	Repository	Open PRs	Stale Items	Notes
1	fro-bot/agent	3	0	7 security alerts (1 critical)
2	fro-bot/.github	2	0	3 security alerts
3	fro-bot/systematic	0	0	1 open issue (not stale)
4	fro-bot/fro-bot.github.io	0	0	1 open issue (not stale)

Recommended Actions

• URGENT: Review and merge security fixes for handlebars in fro-bot/agent (critical CVE)
• Merge pending Renovate PRs to resolve brace-expansion and picomatch vulnerabilities
• Monitor systematic#1 and fro-bot.github.io#1 for staleness (approaching 30 days)
• Review .github security alerts for transitive dependency vulnerabilities

---

Run Summary

Field	Value
Event	schedule
Repository	fro-bot/.github
Run ID	23675660412
Cache	hit
Session	ses_2cdb01369ffeyUD0FGDGvFIox2