PR pipeline has stalled since 2026-06-16 — 56 open PRs, heavy duplication, nothing merging

[dmchaledev]

Problem

No PR has merged into main since 2026-06-16 (#66/#68/#69/#71). Since then, an automated review/fix routine has kept running on the same unmerged baseline and has opened 56 open PRs (is:pr is:open → total_count: 56) plus several open issues — most from claude/nice-mendel-* branches, one per run. Because the baseline never moves, each run rediscovers the same gaps and opens a new PR for them instead of finding the previous fix already proposed. The result is heavy duplication and a backlog nobody is triaging:

Duplicate clusters (same underlying fix, proposed multiple times):

• CSP wildcard/bare-scheme source detection in object-src/sensitive directives: fix(csp): flag object-src wildcard as a high-risk misconfiguration #52, fix(csp): flag scheme-only sources (https:, data:) as permissive in sensitive CSP directives #58, fix(csp): flag wildcard object-src as a security risk #59, fix(csp): detect scheme-only sources (e.g. https:) as permissive in sensitive directives #64, fix(csp): detect scheme-only permissive sources (e.g. https:) in CSP directives #67, fix(csp): flag wildcard and bare-scheme sources in object-src #84, CSP: flag policies missing both default-src and object-src #97 (7 PRs) — note the general bare-scheme case was already fixed and merged in fix(csp): flag bare-scheme sources (e.g. https:) as permissive in CSP directives #68 on 2026-06-16, so several of these may now be partially/fully redundant.
• --timeout CLI arg validation (prevent silent NaN/immediate-abort): fix: validate --timeout CLI arg to prevent silent NaN abort #61, fix: --timeout NaN causes immediate request abort #77, fix(cli): validate URL and --timeout before fetching #82, fix(cli): validate --timeout value instead of silently coercing to NaN #100 (4 PRs).
• Configurable CI-gate threshold (--min-grade/--fail-on): feat(cli): add --min-grade flag for configurable CI exit threshold #55, feat(cli): add --fail-on flag to make the CI gate threshold configurable #56, feat(cli): add --fail-on grade option for configurable CI gate threshold #73, Add --min-grade flag for configurable CI gate threshold #74 (4 PRs).
• CLI/fetch integration test coverage: Enforce test coverage thresholds in CI #63, test(fetch): add full test coverage for fetchHeaders #83, test(fetch): add full test coverage for fetchHeaders #85, test: add CLI and fetch integration tests (closes #65) #89 (4 PRs).
• Referrer-Policy comma-separated list parsing: fix(referrer-policy): parse comma-separated fallback list per spec #75, fix: parse Referrer-Policy as comma-separated list per W3C spec #86 (2 PRs).
• SSRF protection in fetchHeaders: fix(security): block SSRF in fetchHeaders — reject private/internal targets #92, fix: add SSRF protections to fetchHeaders #99 (2 PRs, both address issue fetchHeaders has no SSRF protection — arbitrary/internal URLs are fetched unchecked #91).
• Release pipeline fix (tag → publish never firing): ci: fix npm publish never firing after automated release tags #98 (addresses package.json version and CHANGELOG.md are stale — repo says 1.0.1, npm has shipped v1.0.2/v1.0.3 with grade-changing rule fixes and no changelog entries #94).
• package.json/CHANGELOG version drift backfill: fix: sync package.json version with published tags, backfill changelog #101 (also addresses package.json version and CHANGELOG.md are stale — repo says 1.0.1, npm has shipped v1.0.2/v1.0.3 with grade-changing rule fixes and no changelog entries #94).

Separately, three Dependabot PRs (#78, #80, #96) are sitting unmerged with no apparent conflicts.

I checked commit status on two of the highest-value PRs (#98 — fixes the broken npm publish pipeline, and #99 — SSRF hardening) and both show state: pending with total_count: 0 — i.e. no CI check results are attached at all, which is itself worth a maintainer look (either CI isn't running on these branches, or the status API isn't surfacing check-runs).

Why this is high-leverage right now

• The repo's automated review/fix routine is doing its job (finding real bugs — SSRF, broken releases, CSP gaps) but the output is being generated faster than it's consumed. Left alone, the backlog and duplication will keep compounding every run.
• Several of the open PRs are not cosmetic — ci: fix npm publish never firing after automated release tags #98/fix: add SSRF protections to fetchHeaders #99/fix(security): block SSRF in fetchHeaders — reject private/internal targets #92 fix a currently-broken npm release pipeline and a live SSRF gap (issue fetchHeaders has no SSRF protection — arbitrary/internal URLs are fetched unchecked #91). These are the ones with the most user impact and should be prioritized out of the pile.
• This is a process gap, not a code gap — no source change fixes it. It needs a maintainer triage pass.

Proposed action

1. Triage in this order: ci: fix npm publish never firing after automated release tags #98 (unblocks releases) → fix: add SSRF protections to fetchHeaders #99 or fix(security): block SSRF in fetchHeaders — reject private/internal targets #92 (SSRF, pick one, close the other as duplicate) → fix: sync package.json version with published tags, backfill changelog #101/package.json version and CHANGELOG.md are stale — repo says 1.0.1, npm has shipped v1.0.2/v1.0.3 with grade-changing rule fixes and no changelog entries #94 (version/changelog backfill, depends on ci: fix npm publish never firing after automated release tags #98 landing first) → the test-coverage and CLI-flag clusters (pick the most complete PR per cluster) → the CSP wildcard cluster (verify what fix(csp): flag bare-scheme sources (e.g. https:) as permissive in CSP directives #68 already covered, close what's now redundant) → Dependabot PRs (chore(deps-dev): bump vitest from 4.1.7 to 4.1.9 #78, chore(deps-dev): bump @vitest/coverage-v8 from 4.1.7 to 4.1.9 #80, chore(deps-dev): bump @types/node from 20.19.41 to 26.1.0 #96 — likely safe fast-forwards).
2. Close duplicates explicitly with a comment pointing to whichever PR in each cluster is being kept, rather than leaving them open indefinitely.
3. Confirm CI actually runs on these branches — the pending/total_count: 0 status on ci: fix npm publish never firing after automated release tags #98 and fix: add SSRF protections to fetchHeaders #99 suggests checks may not be attached; worth a quick look before merging anything.
4. Prevent recurrence: if the automated routine that opens these PRs/issues can search existing open PRs/issues touching the same file or topic before filing a new one, it would stop re-proposing fixes that are already sitting in the queue.

Scope

No source changes proposed here — this is a repo-hygiene/triage issue covering .github PR backlog across the branches/PRs listed above.

[dmchaledev]

Update (2026-07-16): Backlog has grown to 57 open PRs (up from 56), including one new genuinely non-duplicate fix since this issue was filed (#107 — ALLOW-FROM scoring). This confirms the pattern: even a careful run that checks for duplicates before opening a PR still can't get anything merged, because nothing is merging at all right now.

Found the likely root cause of the freeze itself, not just the backlog symptom: main's current HEAD (0ce2274, the commit that introduced the Node 18/20/22 CI matrix in #66) has a failing CI run (run 27606677557). The Node 18 leg crashes before any test runs — vitest@4.1.7's dependency chain (vite → rolldown) requires Node ^20.19.0 || >=22.12.0 and throws SyntaxError: ... 'node:util' does not provide an export named 'styleText' on Node 18. I confirmed the same failure on #98's and #99's Node 18 legs too — it's not specific to any one PR's diff, every open PR inherits it.

So CI has been red on main and on every open PR since the day this all stalled (2026-06-16). If the Node 18 check is a required status check, that alone would fully explain "no PR has merged since 2026-06-16" independent of the auto-tag/publish.yml token issue #98 describes — and even after #98 merges, nothing else can merge while this stays red.

Opened #108 to fix it (drop Node 18 from the matrix; verified typecheck/test/build all green locally on Node 20/22). It's small and self-contained, and doesn't overlap any of the 57 open PRs.

Correction to my read of the earlier "pending / total_count: 0" commit-status observation on #98/#99: that was the legacy Statuses API, which GitHub Actions doesn't populate — the Checks API (get_check_runs) shows the real per-job results, which is how the Node 18 failures above were confirmed. Worth using that API for any future triage here.

Per this issue's own recommendation ("if the automated routine... can search existing open PRs/issues... before filing a new one"), I did not open a new issue for this pass — landed #108 as a PR instead, and added this as an update here rather than a duplicate tracking issue.

---

Generated by Claude Code