[hivecommons-hive]

Closes #520

The gate stored active exceptions in a Map keyed by GHSA id alone, so a second entry for the same GHSA with a different package overwrote the first. The schema's package field exists precisely to let one GHSA be acknowledged per package; the dropped entry left its advisory blocking and never showed up in unused, hiding the cause. Exceptions are now keyed by id plus package (unscoped = wildcard), lookups prefer the package-scoped entry then fall back to the unscoped one, and unused is tracked per entry.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

❌ Deploy Preview for hivecommons-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	d16cc66
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ae409328058e7861677c3e5

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Logic looks correct to me; the red TypeScript & ESLint check is this PR's own formatting and needs one prettier --write.

What I verified in the tree at eeba3b0:

• scripts/npm-audit-gate.ts:126-128 — exceptionKey uppercases the id and uses * for an unscoped package. collectAdvisories (:88-90, ghsaIdFromUrl) already returns uppercase GHSA ids, so the exception-side and advisory-side keys agree; the previous active.get(adv.id) lookup had the same casing contract.
• :170-178 — lookup prefers the id:package key and falls back to id:*; used now records the key actually matched, so unused (:180-182) is per entry. A scoped entry for pkg-a plus an unscoped one correctly leaves the unscoped entry marked used only when some other package consumed it — that is the behaviour the second new test pins.
• Both new tests in scripts/npm-audit-gate.test.ts:198-232 fail on main (the second active.set overwrote the first) and pass with the change.

Blocking CI failure (this diff's fault): npm run format:check fails on scripts/npm-audit-gate.test.ts — job 123858769530. Prettier wants the two report.vulnerabilities literals wrapped; running the repo's pinned Prettier locally produces exactly this:

-        "pkg-a": { via: [{ name: "pkg-a", url: BRACES_URL, severity: "high" }] },
-        "pkg-b": { via: [{ name: "pkg-b", url: BRACES_URL, severity: "high" }] },
+        "pkg-a": {
+          via: [{ name: "pkg-a", url: BRACES_URL, severity: "high" }],
+        },
+        "pkg-b": {
+          via: [{ name: "pkg-b", url: BRACES_URL, severity: "high" }],
+        },

at lines 201-202 and 219-220. npx prettier --write scripts/npm-audit-gate.test.ts and push.

Open question (not verified as this PR's fault): the Netlify deploy-preview checks also failed, but the diff touches only scripts/ and changelog.d/ and Lint and build passed, so I expect those to be unrelated to the change.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The fix is correct; the only thing holding this back is Prettier.

Logic (read against main): collectAdvisories already dedupes by ${id}:${packageName} (scripts/npm-audit-gate.ts:103), so advisories arrive one-per-package; the old active map keyed by bare GHSA id (:154 on main) was the sole place the second scoped entry got dropped. The new exceptionKey (:126) plus the scoped-then-wildcard lookup (:170-172) closes that, and tracking used by key makes unused per entry as the body says. I checked the pre-existing keeps the second package blocking with a %s first package and scoped exception case: with only a pkg-a exception, pkg-b misses both the scoped and the * key and stays blocking, so no regression there.

Why CI is red: TypeScript & Lint Check fails in the Prettier step on scripts/npm-audit-gate.test.ts only. Lines 201–202 and 219–220 ("pkg-a": { via: [{ name: "pkg-a", url: BRACES_URL, severity: "high" }] },) are 86 columns against printWidth: 80; prettier --write scripts/npm-audit-gate.test.ts reflows each into a three-line object literal and nothing else changes. npm audit and Build on the same head are green.

Nothing else to flag from the correctness, security, intent or docs angles — the changelog fragment describes exactly what the diff does and closes #520 as stated.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (style) — approve; one advisory note.

• scripts/npm-audit-gate.ts:127 — exceptionKey uses pkg ?? "*", while the replaced check (!ex.package || ex.package === adv.package) treated an empty-string package as unscoped. An entry with "package": "" is now keyed GHSA-…: and will match nothing (always unused). pkg || "*" preserves the previous semantics; otherwise fine as-is given package?: string is the documented shape (scripts/npm-audit-gate.ts:34).

Non-blocking.

— hive: agent=adjudicator-4 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Hive filed review findings that do not block this PR as backlog items:

• Review backlog (docs-currency): Header docstring never documents the optional package exception field #523 — Review backlog (docs-currency): Header docstring never documents the optional package exception field (Review backlog (docs-currency): Header docstring never documents the optional package exception field #523)

Cap: 10 backlog item(s) per PR per day.

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator-3 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (correctness) — no in-scope findings. Composite-key logic in scripts/npm-audit-gate.ts:126-128,158,170-180 is correct; scoped lookup falls back to the :* entry, unused is per-entry. Confirmed the new test honours one scoped exception per package for the same GHSA fails on merge-base 546d740 and passes at d16cc66 (35/35).

Advisory, out of scope: main() still prints ::warning::Unused npm audit exception ${ex.id} — remove it. (scripts/npm-audit-gate.ts:241). Now that several entries can legitimately share one GHSA, that line can't tell the author which entry is unused; appending ex.package ?? "*" would make it actionable.

— hive: agent=adjudicator-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#521d16cc66` sha256:769843bd1a9780b53433d478023f582ed0bb24819ec0be41c506c245b7d41ace — download from the dashboard or `hivectl review evidence #521`.