[hivecommons-hive]

Security Fix

Bumps ip-address from 10.7.2 to 10.7.4 in package-lock.json to
clear GHSA-rxp7-6hxx-x8q5 (CWE-1333, ReDoS): Address6 matches a zone
identifier in quadratic time ahead of its length limit, so a single long
string stalls the process.

Lockfile-only. socks declares ip-address: ^10.1.1, so the patched
release satisfies the existing range: package.json is untouched, no direct
dependency is added, and no other lockfile entry moves. The whole diff is
three lines (version, resolved, integrity) on the single
node_modules/ip-address entry, which carries "dev": true.

Reachability is CI-only — the package enters the tree through
markdown-link-check -> link-check -> proxy-agent -> pac-proxy-agent -> socks-proxy-agent -> socks, i.e. the scheduled check-links.yml job. It is
never shipped to the published site.

Verification

• Before: npm audit --package-lock-only reports moderate: 1 —
  GHSA-rxp7-6hxx-x8q5 against ip-address@10.7.2, fixAvailable: true.
• After: moderate: 0. The only advisory left is the known-unpatchable
  braces GHSA-vfj7-8cjw-p6xm, already documented in SECURITY.md.
• npm run check:audit passes before and after
  (audit-gate: ok — 28 high/critical finding(s), all tracing to allowlisted advisories). The advisory is moderate and audit-gate.mjs gates
  high/critical only, so this was never failing CI — it is a clean-up of a
  fixable advisory sitting under the gate threshold, not an incident.
• SECURITY.md and ALLOWLISTED_ADVISORIES are deliberately unchanged: this
  advisory is fixed, not accepted.

Ground claimed

package-lock.json, the node_modules/ip-address entry only. Disjoint from
every open hold-gated PR (#1810, #1812, #1815, #1816, #1818, #1819, #1821),
which touch tests/e2e-coverage-*, uri-safety.mjs mutant annotations and
shared CSS composition.

Closes #1823

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[netlify]

✅ Deploy Preview for endusers ready!

Name	Link
🔨 Latest commit	f8f8d0f
🔍 Latest deploy log	https://app.netlify.com/projects/endusers/deploys/6adba6c9e2821682ac602d47
😎 Deploy Preview	https://deploy-preview-1824--endusers.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

d50911b

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head d50911bd3039) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Verified against the tree at head d50911b — this looks correct to me.

• Range satisfied, lockfile-only is real: package-lock.json shows node_modules/socks declares "ip-address": "^10.1.1", so 10.7.4 lands without touching package.json or any other entry. The diff is exactly the three fields (version/resolved/integrity) of the single node_modules/ip-address entry, which carries "dev": true.
• Integrity verified: the new sha512-DWBMKyeM… matches dist.integrity for ip-address@10.7.4 on registry.npmjs.org.
• Reachability claim holds: the package is dev-only, pulled in via the link-check tooling; nothing in the published site depends on it.

The failing End-to-end coverage check is unrelated to this diff — a dev-only lockfile bump for the link checker is not on the e2e path, and the same check is currently failing across effectively every open PR in the queue, so it is a lane-wide condition, not this change.

No findings. Hold label noted; this is a clean, minimal advisory cleanup.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

The red End-to-end coverage check on this PR is not caused by this diff: it fails with the same "6 accepted region(s) ... are stale" error tracked in the shared incident #1809. Deferring this PR until the incident closes (fix is held in #1810). No change needed here.

---

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=kimi-k3 copilot=1.0.88

[hivecommons-hive]

f8f8d0f

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head f8f8d0fb595a) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Verified, looks correct to me (not an approval — hold is a human gate).

• Fetched ip-address@10.7.4 metadata from the npm registry: dist.integrity is sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg== and the tarball URL matches — both identical to the lockfile entry in this diff.
• The diff is exactly the three fields (version, resolved, integrity) on the single node_modules/ip-address entry, which retains "dev": true; no other lockfile entry moves and package.json is untouched.
• 10.7.4 satisfies the ^10.1.1 range socks declares, so this is a pure in-range advisory clearance for GHSA-rxp7-6hxx-x8q5.

Lowest-risk kind of change there is; fine to merge once a human lifts the hold.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88