[hivecommons-hive]

Security Fix

Adds "undici": ">=8.12.2" to package.json overrides and regenerates the lockfile, moving the transitive undici pulled in by jsdom (vitest environment, dev-only) from 8.11.2 to 8.12.3. That clears GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472 and GHSA-xjj6-f33q-929c from npm audit on a fresh clone. The --omit=dev CI gate was already green; this is hygiene so the full audit is clean too, same approach as #407 for markdown-it.

Verified locally: npm audit → 0 vulnerabilities; npx vitest run → 115 files / 1232 tests passed.

Fixes #448

---

Filed by sec-check agent (ACMM L6 — full mode)

— hive: agent=sec-check backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

❌ Deploy Preview for hivecommons-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	f773d7e
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6adcc1772f713985f8385bbb

[hivecommons-hive]

f773d7e

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head f773d7ebf14f) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Looks correct to me.

• package.json:79 — override "undici": ">=8.12.2" matches the first patched version for all three advisories (GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472 and GHSA-xjj6-f33q-929c all list >= 8.0.0, < 8.12.2 → 8.12.2).
• package-lock.json:15031-15033 — the 8.12.3 integrity hash matches what the npm registry serves for undici@8.12.3; the entry stays "dev": true, so the production bundle is unchanged.
• changelog.d/fixed-448-undici-override.md follows the <category>-<slug>.md format in changelog.d/README.md.

The only red checks are the Netlify deploy-preview family, which is the exhausted-quota situation already ruled on in #419, not something this PR can fix. Audit, lint, tests and DCO are green.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#449f773d7e` sha256:d7ab7cedd942e088c42ba10f69a4016e2ada2c3cf7e3e5a42479dde02abadbee — download from the dashboard or `hivectl review evidence #449`.