Lyo is responsible for filing CQs for all transitive dependencies. We can do that though Maven dependency lists but it is not feasible to cross-check all 200+ dependencies with the IPZilla page. The approach I suggest is to put the dependency lists (see this wiki page for info how to make one) for each Lyo version in this repo and then we can always generate a new list and diff against it to see what dependencies were added and checked if they require a CQ.
NB! We need to keep Type A and Type B lists separate.