🐛 fix(deps): bump golang.org/x/net to v0.62.0 to clear GO-2026-6860 by hivecommons-hive[bot] · Pull Request #14731 · hivecommons/hive

hivecommons-hive · 2026-10-27T22:34:20Z

govulncheck (known vulnerabilities) has been red on every PR since GO-2026-6860 was published against golang.org/x/net v0.61.0. pkg/knowledge/connector/htmlmd.go calls html.ParseFragment via richHTMLToMarkdown, which is affected; the fix is in v0.62.0.

Bumps golang.org/x/net to v0.62.0 (go.mod/go.sum) and adds a security changelog fragment. go mod tidy also promoted charmbracelet/x/ansi v0.10.1 from indirect to direct.

Closes #14726

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>

kubestellar-prow · 2026-10-27T22:34:24Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nicholasjackson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hivecommons-hive · 2026-10-27T22:34:54Z

da9113a

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head da9113aa32f4) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
- src/go.mod

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

github-actions · 2026-10-27T22:35:00Z

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

hivecommons-hive · 2026-10-27T22:35:04Z

hive/awaiting-ci: CI pending — sweep will merge when green.

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

hivecommons-hive

The bump itself is right and minimal; one generated file is stale.

src/go.mod / src/go.sum: golang.org/x/net v0.61.0 → v0.62.0, the go.mod hash line unchanged as expected. The charmbracelet/x/ansi promotion to a direct require is legitimate — src/pkg/tui/panes/hives_tree.go imports it directly, so this is go mod tidy catching up, not scope creep.
changelog.d/security-govulncheck-xnet.md uses the security- prefix the fragment guard accepts.
Confirmed the motivating failure is real: the govulncheck job on #14730 (same base) reports GO-2026-6860 found in golang.org/x/net@v0.61.0, fixed in v0.62.0.

Gap (low): NOTICE:4823 still reads Version: v0.61.0 under Package: golang.org/x/net, so NOTICE matches the module graph fails at da9113a — check-notice-drift.sh shows exactly that one-line diff. notice-autofix.yml runs on workflow_run and should push the regenerated file to this branch; if it has not by the time a maintainer looks, src/scripts/generate-notice.sh and commit NOTICE verbatim is the whole fix. Nothing else blocks this.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>

hivecommons-hive · 2026-10-27T23:00:34Z

hive/awaiting-ci: NOTICE regenerated for x/net v0.62.0; CI pending — sweep will merge when green.

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: fcd5054ef

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

hivecommons-hive

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

hivecommons-hive

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

hivecommons-hive

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

hivecommons-hive · 2026-10-27T23:12:13Z

fcd5054

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head fcd5054ef5a1) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
- src/go.mod

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

hivecommons-hive · 2026-10-27T23:14:35Z

Evidence bundle `#14731 fcd5054` sha256:8363e1c38aa8581f9b6e2aa66ee3cba562fbff13c7a16fab4e05e8b39f59e72f — download from the dashboard or `hivectl review evidence #14731`.

github-actions · 2026-10-27T23:14:39Z

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

…n v6 govulncheck fails on v6 because golang.org/x/net v0.61.0 is affected by GO-2026-6860 (quadratic complexity coalescing text nodes in html; reached via connector.richHTMLToMarkdown -> html.ParseFragment). Bump to v0.62.0, regenerate go.sum and NOTICE. Forward-port of #14731 (cherry picked from commit 648ca07) Signed-off-by: Andy Anderson <andy@clubanderson.com>

…n v6 (#14753) govulncheck fails on v6 because golang.org/x/net v0.61.0 is affected by GO-2026-6860 (quadratic complexity coalescing text nodes in html; reached via connector.richHTMLToMarkdown -> html.ParseFragment). Bump to v0.62.0, regenerate go.sum and NOTICE. Forward-port of #14731 (cherry picked from commit 648ca07) Signed-off-by: Andy Anderson <andy@clubanderson.com>

fix(deps): bump golang.org/x/net to v0.62.0 for GO-2026-6860

da9113a

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>

kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Oct 27, 2026

kubestellar-prow Bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Oct 27, 2026

github-actions Bot added the copilot label Oct 27, 2026

hivecommons-hive Bot mentioned this pull request Oct 27, 2026

🐛 fix(agent): exempt ci-maintainer/quality lane variants from CI-poll nudge #14732

Merged

This was referenced Oct 27, 2026

🌱 refactor(proxy): split github_proxy.go by concern (move-only) #14733

Merged

🐛 fix(scripts): action-pins gate fails silently on a tree with no pins; add self-test #14730

Merged

hivecommons-hive Bot commented Oct 27, 2026

View reviewed changes

hivecommons-hive Bot mentioned this pull request Oct 27, 2026

🐛 fix(ioscan): name classifier error and fix in blocked-kick warning #14722

Merged

fix(deps): regenerate NOTICE for golang.org/x/net v0.62.0

fcd5054

Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>

kubestellar-prow Bot removed the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Oct 27, 2026

kubestellar-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Oct 27, 2026

hivecommons-hive Bot mentioned this pull request Oct 27, 2026

🐛 contribute: match disabled_repos entries by exact repo name #14716

Merged

hivecommons-hive Bot added stage/050-review-pending Review swarm requested; awaiting a verdict for the current head and removed stage/070-fixing Hive-authored PR: CI red, changes requested or needs rebase; a hive agent is fixing it labels Oct 27, 2026

This was referenced Oct 27, 2026

🐛 fix: pack agents follow the hive's inference gateway #14710

Closed

🐛 bug: feedback button overlaps other header content #13135

Closed

hivecommons-hive Bot commented Oct 27, 2026

View reviewed changes

hivecommons-hive Bot merged commit 648ca07 into v5 Oct 27, 2026
76 of 79 checks passed

kubestellar-prow Bot deleted the scanner/fix-govulncheck-xnet branch October 27, 2026 23:14

hivecommons-hive Bot removed role/trusted Author is trusted for unattended merge (trusted-author role or registry/claim tier in require_tiers) stage/050-review-pending Review swarm requested; awaiting a verdict for the current head labels Oct 27, 2026

This was referenced Oct 28, 2026

ci: govulncheck fails on v6 (GO-2026-6860) #14751

Closed

🐛 deps: patch golang.org/x/net for GO-2026-6860 so govulncheck is green on v6 #14753

Merged

This was referenced Oct 28, 2026

govulncheck red on crux main: GO-2026-6617/6612/6611/6603 in src/crux golang.org/x/net v0.59.0 #14781

Closed

🐛 deps: bump golang.org/x/net to clear govulncheck finding #14782

Merged

Navigation Menu

Repository navigation

🐛 fix(deps): bump golang.org/x/net to v0.62.0 to clear GO-2026-6860 - #14731

🐛 fix(deps): bump golang.org/x/net to v0.62.0 to clear GO-2026-6860#14731
hivecommons-hive[bot] merged 2 commits into
v5from
scanner/fix-govulncheck-xnet

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

kubestellar-prow Bot commented Oct 27, 2026

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

hivecommons-hive Bot left a comment

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

hivecommons-hive Bot left a comment

Uh oh!

hivecommons-hive Bot left a comment

Uh oh!

hivecommons-hive Bot left a comment

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

kubestellar-prow Bot commented Oct 27, 2026

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Uh oh!

github-actions Bot commented Oct 27, 2026

Open PR overlap check

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

hivecommons-hive Bot left a comment

Choose a reason for hiding this comment

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

hivecommons-hive Bot left a comment

Choose a reason for hiding this comment

Uh oh!

hivecommons-hive Bot left a comment

Choose a reason for hiding this comment

Uh oh!

hivecommons-hive Bot left a comment

Choose a reason for hiding this comment

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Uh oh!

Uh oh!

hivecommons-hive Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants