[hivecommons-hive]

Security Fix

re2js@2.8.6, pinned exactly by markdownlint@0.42.0 (used via
markdownlint-cli2 / npm run lint:md), is affected by a quadratic-time
DoS in lookbehind matching (GHSA-gg6h-894w-4m9c / CVE-2026-116795): any
LOOKBEHINDS-flagged pattern turns find/matchAll/split/replaceAll
into Θ(n²) scans instead of RE2JS's advertised linear-time guarantee.

Since markdownlint pins an exact (non-range) re2js version, the fix can't
reach us via a normal bump — this adds an npm overrides entry forcing
the resolved re2js to the patched 2.9.1, the same pattern already used
in this repo for minimatch, undici, nanoid, axios, etc.

Verified markdownlint-cli2 still runs cleanly against README.md/
CONTRIBUTING.md with the overridden version; npm audit no longer reports
the re2js high-severity advisory (3 of the prior 20 findings resolved; the
remaining 17 moderate minimatch findings are a pre-existing npm-audit
false positive — minimatch is already overridden to 3.1.4 everywhere,
which predates the vulnerable v10+ code path).

Fixes #7545

---

Filed by sec-check agent (ACMM L6 — full mode)

— hive: agent=sec-check backend=copilot model=claude-opus-4.7 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for kubestellar-docs ready!

Name	Link
🔨 Latest commit	3c0374c
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellar-docs/deploys/6ae7e911fbcf96533a867a37
😎 Deploy Preview	https://deploy-preview-7546--kubestellar-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[kubestellar-prow]

Hi @hivecommons-hive[bot]. Thanks for your PR.

I'm waiting for a kubestellar member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[hivecommons-hive]

3c0374c

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 3c0374c7119e) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Read the tree at head 3c0374c, not just the diff.

• package.json: re2js: ^2.9.1 is added inside the existing overrides block (alongside minimatch, undici, nanoid, etc.), matching the repo's established pattern for forcing transitively-pinned deps.
• package-lock.json: resolved re2js moves 2.8.6 → 2.9.1 with a matching integrity hash; 2.9.1 is the patched release for GHSA-gg6h-894w-4m9c.
• Only side effect in the lockfile is engines.node rising to >=20.0.0 for re2js; all CI checks (TypeScript & ESLint, unit tests, verify, Playwright smoke, netlify deploy preview) passed at this head, so the toolchain already runs ≥20.

Dev-only dependency (markdownlint path), no runtime surface. Looks correct to me — matches the stated goal exactly, no scope creep.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#75463c0374c` sha256:05c2e01dd7054bdc792a2a58ec495f019329b18a6ec25b1ae8150bc5c0379f3e — download from the dashboard or `hivectl review evidence #7546`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey