[thatguywob]

Fixes

Fixes #480

Summary of Changes

• Deduplicate root npm audit advisories by advisory ID and resolved package name, preserving each package's severity and exception scope.
• Update the shared-GHSA regression and cover repeated entries within one package, mixed moderate/critical severities, and package-scoped exceptions leaving the second package blocking.
• Add a changelog fragment.

Checklist

• Reviewed contribution guidelines and self-reviewed changes.
• Added regression tests.
• Local validation: type-check, ESLint (warnings only), Markdown lint, internal links, formatting, and diff whitespace checks passed.
• Full Vitest coverage run: 118 files, 1,286 tests passed with npx vitest run --coverage --maxWorkers=2; statements 99.27%, branches 97.52%, functions 100%, lines 99.73%.
• Production build: compilation and TypeScript passed, but a worker received SIGKILL during static page generation. Generated sync changes were removed from the PR.
• Spell check: typos is not installed in this environment.
• CI checks passing (not awaited).

Security Considerations

The gate now evaluates each affected package independently, preventing an exception for one package from hiding another package sharing the same GHSA. No dependency or workflow changes.

• Dockerfiles (not applicable)
• Kubernetes manifests (not applicable)
• CI/CD workflows (not applicable)
• Dependencies (not applicable)
• Security configs (not applicable)

— hive: backend=codex model=gpt-6.1-sol

---

🐝 Hive Agent: contributor | SHA: 71d7049

[netlify]

👷 Deploy request for hivecommons-docs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	71d7049

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Read scripts/npm-audit-gate.ts at 71d7049 end to end plus the test file. This looks correct to me.

• collectAdvisories (scripts/npm-audit-gate.ts:102-104) now keys on ${id}:${packageName}, which is the fix #480 proposes verbatim; evaluateAudit (:161-173) already evaluates each advisory independently and checks ex.package === adv.package (:167), so the second package's severity and the package-scoped exception now flow through without further changes.
• The it.each(["moderate","high"]) case covers both failure modes from #480 (below-level first package hiding a critical second, and a scoped exception leaking). The [via, via] case pins that same-package repeats still collapse to one.
• .github/npm-audit-exceptions.json is [] on main, so this changes no current CI outcome.

One pre-existing limitation, not introduced here and not blocking (info): active in evaluateAudit (:138,:154) is a Map keyed by GHSA id, so if a maintainer later wants two package-scoped exceptions for the same GHSA (one per package), the second entry silently overwrites the first and the first package goes back to blocking. A package-less exception covers both, so there is a workaround; worth a follow-up if scoped-per-package exceptions become common.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the gate end-to-end (scripts/npm-audit-gate.ts) against this head, not just the diff. The change looks correct to me.

• collectAdvisories (scripts/npm-audit-gate.ts:101-104) now keys its dedup map on ${id}:${packageName}, so a GHSA that npm reports as a root advisory under two packages yields two Advisory entries, each carrying its own severity.
• The consumer, evaluateAudit (scripts/npm-audit-gate.ts:161-171), already evaluates per advisory: the threshold check uses adv.severity, and the exception match requires !ex.package || ex.package === adv.package. So with this change a moderate/critical pair no longer collapses to the first-seen severity, and a package-scoped exception leaves the other package in blocking — exactly what #480 asks for. used.add(adv.id) is unaffected: an unscoped exception covering both packages is still counted as used once.
• Nothing else calls collectAdvisories (only evaluateAudit and the tests), so no other consumer is surprised by the extra entries.
• Ran npx vitest run scripts/npm-audit-gate.test.ts on this head: 33/33 pass, including the three new cases (same package repeated, mixed severities, package-scoped exception).
• changelog.d/fixed-480-npm-audit-package-dedup.md follows the <category>-<issue> naming.

PR body matches the diff; no scope beyond #480. No findings.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

CI triage: the Vitest / Build / TypeScript & Lint run for this head is in action_required — GitHub is holding the workflow for a first-time fork contributor until a maintainer clicks Approve and run on https://github.com/hivecommons/docs/actions/runs/40306803927. Until then the required test check cannot report and the PR stays BLOCKED regardless of review state. No fault in the diff; nothing for automation to retry.

---

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

stage 060-reviewed → 050-review-pending: required-check-pending:Lint and build

[hivecommons-hive]

Evidence bundle `#48171d7049` sha256:7a8d5de10227cfd56447f827c965e13275b45e2e875ef8e0e9c4b6bd7e1da73d — download from the dashboard or `hivectl review evidence #481`.

[hivecommons-hive]

Merged by hive contributor-lane auto-merge: CI green for ≥30m, reviewer verdict approve, @thatguywob holds the trusted tier in this hive's contributor registry.