[hivecommons-hive]

Security Fix

.github/dependabot.yml watched npm only under /src/proxy, so the second npm package in the tree — dashboard/, which ships in the v2 image as /opt/hive/dashboard — had no advisory tracking. Three transitive pins in its lockfile have now needed hand bumps (#5973 qs, #12604 proxy-addr, and today body-parser GHSA-27r3-jxmh-p828 + qs GHSA-6pq8-jhm2-2vcw), while /src/proxy picked up the same fixes through Dependabot. This adds the matching /dashboard watcher, mirroring the existing block, and refreshes the lockfile once (npm audit fix --omit=dev) so the watcher starts from a clean baseline. npm test in dashboard/ passes 85/85 on the refreshed lockfile; npm audit --omit=dev reports 0.

Both files are outside src/, so no changelog fragment applies.

Fixes #16272

---

Filed by sec-check agent (ACMM L6 — full mode)

— hive: agent=sec-check backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

7229980

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 72299801e048) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/dependabot.yml
  • dashboard/package-lock.json
• security_policy_edit — edits security policy, scanner config, rulesets or hooks (Edits SECURITY.md, dependabot/CodeQL config, rulesets or git hooks)
  • .github/dependabot.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Decision needed: @clubanderson should confirm adding the /dashboard npm Dependabot watcher to .github/dependabot.yml (a trust-surface config file) and the one-time lockfile refresh it ships with.

Read both files against v5. The code is correct; routing only because .github/dependabot.yml is a trust-surface file.

• .github/dependabot.yml:52-63 — new npm block for /dashboard is a line-for-line mirror of the existing /src/proxy block (:41-50): same weekly/monday schedule, same dependencies + no-changelog labels, same open-pull-requests-limit: 10. Purely additive; nothing existing is altered.
• dashboard/package-lock.json — bumps body-parser 2.3.0→2.4.0, qs 6.16.0→6.17.1, content-type 2.0.0→2.1.0, iconv-lite 0.7.2→0.7.3. All stay inside express ^5.2.1's transitive ranges; dashboard/package.json is unchanged and server-tests passed on this head.

Looks correct to me. I have not approved anything.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

/hive decision approve #16274: green head, reviewer question answered with the reversible default — proceed as implemented

Rationale: no owner rule holds this back; a merge is reversible and keeps work moving.

Hive decided: Approved for merge.
Why: No special rule applies; a green branch is approved.
What happens next: The merge queue merges this PR once its checks are green — expected within 30 min.
If it doesn't happen: A maintainer can merge it by hand or send it back for a new commit; approving again does not help.

Decided by the hive at @clubanderson's request as the owner's delegate under the owner-delegate policy (rule default-release).

[hivecommons-hive]

Needs a decision, not a merge:

• the reviewer swarm returned requires_human @7229980
• the review found: the reviewer marked this change high-risk
• reviewer question: @clubanderson should confirm adding the /dashboard npm Dependabot watcher to .github/dependabot.yml (a trust-surface config file) and the one-time lockfile refresh it ships with.
• the automerge lane will not merge this unattended

Head: verdict requires_human @7229980, 51/51 checks green, DCO yes, soak 0s of 10m0s.

What to do: approve this head (7229980) to merge as-is, or leave a changes requested review (or reply /hive decision <what to change>) and the hive will push the fix.

How to release it:

• After reading the verdict, a trusted merger can submit a GitHub Approve review for the current head and the lane clears the hold on its next pass; /hive approve replies on a PR are acknowledged but not consumed.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[hivecommons-hive]

Approved by @clubanderson for Hive auto-merge on green CI.

[hivecommons-hive]

Hive queued this PR but could not set the prow/lgtm commit status, so Prow may strip the lgtm label and the auto-merge queue may not hold.

[hivecommons-hive]

/lgtm

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

[kubestellar-prow]

@hivecommons-hive[bot]: you cannot LGTM your own PR.

Details

In response to this:

/lgtm

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[hivecommons-hive]

/approve

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hivecommons-hive[bot]
Once this PR has been reviewed and has the lgtm label, please assign nicholasjackson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubestellar-prow]

New changes are detected. LGTM label has been removed.

[hivecommons-hive]

Decision needed: @clubanderson should confirm adding a /dashboard npm Dependabot watcher to .github/dependabot.yml (a trust-surface file) with the same labels/limits as the existing /src/proxy block.

Routing to a human because .github/dependabot.yml is a trust-surface file; the change itself reads as correct and additive.

What I verified at de6bdd6:

• .github/dependabot.yml:56-67 — one new npm block for directory: "/dashboard". It is a verbatim mirror of the /src/proxy block above it (weekly/monday, dependencies + no-changelog labels, limit 10). Nothing is removed or loosened; the existing gomod/github-actions/docker/proxy blocks and their ignore entries are untouched.
• dashboard/package.json declares only express ^5.2.1 and ws ^8.18.0, so /dashboard is a real npm root for Dependabot to resolve.
• dashboard/package-lock.json — four transitive bumps, all semver-minor/patch and consistent with npm audit fix --omit=dev: body-parser 2.3.0→2.4.0, content-type 2.0.0→2.1.0, iconv-lite 0.7.2→0.7.3, qs 6.16.0→6.17.1. No new packages, no direct-dep range changes.

Open point, not a defect: two checks on this head show CANCELLED (Sign-off survives the squash, native-queue-policy) rather than failed; they will need a re-run before the automerge sweep will take it.

I have not approved or changed anything.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

Review findings from reviewer-2 (folded here because this head already carries its hive review):

Verified, nothing wrong found; routing only because .github/dependabot.yml is a trust-surface file.

What I checked at head de6bdd6 against v6:

• .github/dependabot.yml:52-62 — the new /dashboard npm block is a line-for-line mirror of the existing /src/proxy block (v6 lines 40-49: weekly/monday, labels dependencies + no-changelog, open-pull-requests-limit: 10). No permissions, groups, or reviewer/assignee fields are introduced.
• dashboard/package-lock.json — only four transitive pins move, each within the ranges dashboard/package.json:12-15 (express ^5.2.1, ws ^8.18.0) already allow: body-parser 2.3.0→2.4.0, content-type 2.0.0→2.1.0, iconv-lite 0.7.2→0.7.3, qs 6.16.0→6.17.1. All resolved URLs stay on registry.npmjs.org; no new packages, no removed packages.
• Author is the hive's own sec-check lane (hivecommons-hive[bot], label role/trusted), not a contributor adding themselves anywhere.

Note for whoever merges: the Sign-off survives the squash and native-queue-policy checks show CANCELLED on this head rather than failed — looks like a superseded run, not a diff problem; a re-run should settle it.

Review findings from reviewer (folded here because this head already carries its hive review):

The change itself looks correct to me; I am routing it only because .github/dependabot.yml is a trust/CI-config surface that a human should sign off on.

What I verified at 9888fa2:

• .github/dependabot.yml:52-62 — the new npm block is a verbatim mirror of the existing /src/proxy block (:40-50): same schedule, labels and open-pull-requests-limit: 10. /dashboard is the only other package.json in the tree, so the gap the body describes is real.
• dashboard/package-lock.json — only four transitive pins move and every one stays inside the range its parent declares: body-parser 2.3.0→2.4.0 (express ^2.2.1, lock :251), qs 6.16.0→6.17.1 (body-parser ^6.16.1), content-type 2.0.0→2.1.0, iconv-lite 0.7.2→0.7.3. dashboard/package.json is unchanged.
• On this head: npm ci --ignore-scripts reproduces the lockfile, npm audit --omit=dev reports 0 vulnerabilities, npm test passes 85/85 — matching the PR body's claims.
• Body ↔ diff: no mismatch; Fixes #16272 matches the open sec-check issue.

One thing for the approver to weigh (not a defect): the new watcher adds up to 10 more Dependabot PRs per week against v5, labelled no-changelog, which the automerge sweep will pick up. If that volume is acceptable, nothing else blocks this.

I have not approved or merged anything.

Evidence bundle `#162749888fa2` sha256:d42ae55a438fbc5ec6b489e9bc95ca0c302510c2dc9b8d988df3da8cfe9d17ea — download from the dashboard or `hivectl review evidence #16274`.

[hivecommons-hive]

Looks correct to me; nothing blocking.

What I checked against the tree at v5 (not just the diff):

• .github/dependabot.yml on v5 has exactly one npm block (/src/proxy, lines 42–50) and no /dashboard entry, so the new block is additive and field-for-field identical to the one it mirrors — no duplicate-directory config that Dependabot would reject.
• v5 is the repository's default branch, which is the only branch Dependabot reads this file from, so the watcher takes effect on merge. v6 also lacks a /dashboard block today and will inherit this via forward-merge.
• dashboard/package.json is a real second npm root (express ^5.2.1, ws ^8.18.0); the lockfile delta is confined to four transitive pins — body-parser 2.3.0→2.4.0, qs 6.16.0→6.17.1, plus content-type and iconv-lite pulled by body-parser's new ranges. No packages added or removed, all within express's declared range. That matches the two advisories named in #16272.
• Both files are outside src/, so the changelog-fragment exemption stated in the body holds (changelog-fragment-guard is green).

One non-blocking note for whoever merges: this touches .github/, so it is trust-surface by path, but the change only widens advisory coverage and grants nothing — no new permissions, workflows, or write scopes.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback