#github

pickmydegree had been committing the HTML output of its test-coverage run, and CodeQL flagged the Istanbul report’s sorter.js assets as js/xss-through-dom inside that generated output (11e72fc). Those files are test artifacts rather than application code, so coverage/ is now ignored and the committed reports left the tree — roughly 22,800 lines of generated HTML and CSS removed and three added, merged as PR #2. The app source is untouched; only the repository stops carrying a copy of its own coverage run.

Contributed PalomarRegistry/PalomarSubmission#156: registration of an accepted submission had been “under way” for more than seven hours, the status page’s last event being 2026-09-28T08:09:00Z — The submitter asked for this result to be registered, with no palomar/… tag on the repository and no PalomarArchive copy created. The issue reports that this is not local to one submission: the newest repository in the PalomarArchive organisation was created at 06:50Z and none since, for anyone, while the rest of the pipeline looked healthy — 24 workflow runs started in PalomarSubmission since 09:00Z, 20 of them successful.

The receiver’s own day in LeanFrontier was governance rather than mathematics. A pull request whose every changed path is a Markdown file under docs/ is now a documentation proposal (#291): no claim, no Lean, no build, and the three stages that build or run candidate code are gated off, so a prose change costs one short job instead of a Docker build and a Mathlib fetch — decided from the changed paths and never from the branch name, with docs/catalogue/ and docs/website/ excluded because one is generated from the corpus and the other publishes under the project’s name. The friction it removes was real and twice theirs: #290 carries a contributor’s rewritten docs/CONTRIBUTION-DIRECTIONS.md with their authorship after the OWNER gate had refused it, leaving six open directions and marking the ones that have landed.

An MIT licence was added to repositories that had been public without one: cold-path-server-podman, llm-source-security-review, spriter, lifechess, eclipse-3d-sim — whose README was rewritten in the same commit — plus book and daily-drift-run. solids-hunter had a licence file whose text had drifted from canonical MIT; the canonical text is restored and the third-party carve-out it had absorbed lives in THIRD-PARTY.md, where it belonged.

A pass over open dependency advisories bumped the affected packages in every repository that carried them. On the JavaScript side: pickmydegree (vitest, happy-dom, vite, surge), storygen (vitest 4, vite 6, react-router 7), solids-hunter (vitest 4, vite 6.4.3), eclipse-3d-sim, lifechess, agility-trainer and they-live-agent (vitest 4.1.11), platosdf (vitest and its coverage package, 5.0.1), with lockfile refreshes in deck-lovers and express updates in neon-bumper-cars and collective-starship-game.

Seven repositories that had no continuous integration now run their own tests on every push: topshift-trend (running ruff and pytest), caciarabot and python-hosts-checker (pytest), euclean (pytest together with its Lean build), and quadratula, unstated-conclusions and prove2me-logs with smoke tests — in prove2me-logs’ case covering the p2m helper, the piece the mission journal is actually read through.

vitthorio started following this account — a follow says someone is watching, the same way a fork says someone intends to try, so it is worth naming rather than counting. The login is not a stranger to the repositories here: their own fork of jalhund/cold-path-server is the other copy of the Cold Path game server that cold-path-server-podman containerises.

The pull request adding selectable daily clone statistics to hrodrig/gghstats was merged upstream: the “Unique” line on the clones-over-time chart and the compact daily clone panel are now part of the project.

Contributed to hrodrig/gghstats with a pull request that adds selectable daily clone statistics to the repository index: a second “Unique” line on the clones-over-time chart with its legend enabled, plus a compact daily clone panel. The change makes unique cloners visible alongside total clone events.