[hivecommons-hive]

Security Fix

Raises the existing overrides["markdown-it"] floor in package.json from >=14.1.1 to >=15.0.3 and regenerates package-lock.json (node_modules/markdown-it 15.0.2 → 15.0.3). markdownlint-cli2@0.23.3 pins markdown-it: 15.0.1, which resolved inside the affected range of GHSA-gfr2-rv44-r23c and GHSA-vfgh-jcmw-g37q (quadratic-time rendering / inline-HTML DoS); 15.0.3 is the patched release. Same pattern as #133.

Verified locally: npm audit no longer lists either advisory (remaining entries are the acknowledged braces GHSA-vfj7-8cjw-p6xm chain in .github/npm-audit-exceptions.json); npm ci && npm run lint:md → 75 files, 0 issues.

Closes #406

---

Filed by sec-check agent (ACMM L6 — full mode)

— hive: agent=sec-check backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

❌ Deploy Preview for hivecommons-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	b474e00
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ad875754da58a209e3bb9b1

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me — read the lockfile at b474e00, not just the diff.

• package.json:77 raises the overrides["markdown-it"] floor to >=15.0.3; the lockfile has a single node_modules/markdown-it entry at 15.0.3 (package-lock.json:10538), so markdownlint-cli2's markdown-it: 15.0.1 pin (package-lock.json:10628) is overridden rather than duplicated.
• resolved/integrity for markdown-it@15.0.3 and argparse@3.0.3 match the npm registry (checked with npm view).
• 15.0.3 bumps its ranges to argparse ^3.0.3, entities ^8.1.0, linkify-it ^6.1.0; the lock already resolves node_modules/entities 8.1.0 and node_modules/linkify-it 6.1.0, so no nested copies needed.
• The red Netlify checks (Header rules / Pages changed / Redirect rules / deploy-preview) are pre-existing: the same four fail identically on already-merged #404 and #405. Not caused by this change.

Scope matches #406 exactly (two files, dependency floor only).

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me; the only red checks are pre-existing Netlify failures, not this change.

What I verified

• package.json:77 raises the overrides["markdown-it"] floor to >=15.0.3; package-lock.json moves node_modules/markdown-it 15.0.2 → 15.0.3 (and its nested argparse 3.0.2 → 3.0.3). No other packages change.
• GitHub advisory data for both GHSAs lists >= 15.0.0, < 15.0.3 as vulnerable with 15.0.3 as first patched, so the previously locked 15.0.2 was in range and the new floor is the minimal fix.
• markdown-it is dev-only here (pulled in by markdownlint-cli2, package.json:57), so exposure was limited to npm run lint:md on repo-authored Markdown; "Audit production dependencies" passing is consistent with that.
• The failing netlify/hivecommons-docs/deploy-preview (and the three derived Header/Pages/Redirect rows) also failed on already-merged #404 and #405 with the same "Deploy Preview failed." status, so it is a Netlify-side problem that predates this PR. Lint, build, TS/ESLint and unit tests are green.

Nothing blocking from my side; a maintainer may want to look at the Netlify preview config separately.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

b474e00

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head b474e0054f5f) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Evidence bundle `#407b474e00` sha256:d977a84b662c3905011db73f6a42f4a5c7db0daa68a487c16108833074fc2f0f — download from the dashboard or `hivectl review evidence #407`.