docs: Web依存PRの終了結果を記録

[YoneRai12]

Scope

• Records the follow-up closure of superseded web dependency PRs build(deps-dev): bump flatted from 3.3.3 to 3.4.2 in /clients/web #117, build(deps): bump picomatch in /clients/web #119, and build(deps): bump lodash from 4.17.23 to 4.18.1 in /clients/web #127.
• Updates the PR triage ledger and dependency drain ledger so the documented open PR count and close decisions match current GitHub state.

Evidence

• gh api /repos/YoneRai12/YonerAI/dependabot/alerts?state=open&per_page=100 --jq length returned 0.
• Current clients/web/package-lock.json contains flatted 3.4.2.
• Current clients/web/package-lock.json contains picomatch 2.3.2 and nested picomatch 4.0.4.
• Current clients/web/package-lock.json no longer contains a node_modules/lodash package entry.
• The closed PRs only changed clients/web/package-lock.json and no longer carried unique required implementation.

Validation

• git diff --check passed.
• git diff --cached --check passed before commit.
• Changed-file secret scan: no secret values found; token hits are existing explanatory wording only.
• Changed-file local path / username / hostname scan: no hits.
• Mojibake / hidden Unicode scan on changed files: no hits.
• src/cogs/ora.py: unchanged.
• reference_clawdbot: untouched.

Non-claims

This does not claim dependency remediation is complete, production readiness, official cloud completion, hybrid completion, persistent memory, Google login, Discord gateway completion, provider ecosystem completion, Tools/MCP completion, or src/cogs/ora.py resolution.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 91d984bd02

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reconcile closure count with “open dependency PRs” snapshot

This snapshot now records post-closure state (open PR count after ... closures: 33) but still reports Open dependency PRs observed: 16, even though this same update closes 3 dependency PRs (#117/#119/#127), leaving 13 open in the table below. That mismatch makes the ledger internally inconsistent and can mislead later triage decisions that rely on these headline counts.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep dependency snapshot counts in one time basis

In this pass summary, Open dependency PRs observed: 16 is presented next to the post-action totals (Dependency PRs closed ...: 3 and Open PR count after ...: 33), which mixes pre-close and post-close numbers in one snapshot block. Because this section is used as the pass baseline/result, the mixed time basis can misstate the actual remaining dependency backlog after the described closures.

Useful? React with 👍 / 👎.

[gemini-code-assist]

Code Review

This pull request updates the maintenance and security triage documentation to reflect the closure of three web-related dependency PRs (#117, #119, and #127) that were superseded by the current state of the main branch. The changes include updated PR counts, status tables, and revised plans for future dependency lanes. Review feedback identifies an inconsistency in how PRs are grouped between the 'Top 10' list and the 'Next lane split' section, as well as minor punctuation differences between the two ledger files.

[gemini-code-assist]

The grouping in point 9 of the Top 10 list (#152, #151, #150, #146) is inconsistent with the lane split defined in lines 66-68. While point 9 rollup is described as the "high-risk Python dependency lane", the lane split section separates these into three distinct lanes (Python runtime, Discord/crypto, and Provider/media). It would be clearer to maintain consistent grouping or explicitly state that point 9 is a rollup of high-risk items from multiple lanes.

[gemini-code-assist]

The evidence descriptions for #127, #119, and #117 in this file include trailing periods, whereas the corresponding entries in docs/maintenance/OPEN_PR_TRIAGE_2026_05_20.md (lines 108-111) do not. For consistency across triage ledgers, it is recommended to use a uniform punctuation style for evidence strings.