🐝 Hive Advisory Report #23

Activity

1. hivecommons-hive

   added

   hive/advisoryPinned advisory report from Hive agentsPinned advisory report from Hive agents

   on Aug 5, 2026
2. hivecommons-hive commented on Aug 7, 2026

   

   hivecommons-hivebot

   on Aug 7, 2026 – with hivecommons-hive

   Last edited by hivecommons-hive

   ContributorAuthor

   More actions

   🐝 Advisory Digest — 2026-10-13 01:12 EDT

   Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

   Advice

   Frozen for governor mode IDLE until 2026-10-19 (next review in 7 day(s)). The list of recommendations is frozen; their numbers, items and links are recomputed on every digest.

   Counts quoted: governor actionable queue 0 PRs / 1 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 9 open PRs / 1 open issues (every open or held item across repo cards; the queue-health advice counts these).

   • Reduce the blocked PR queue — No longer applies: the signal that triggered this advice has cleared since the epoch began.
   • Give idle agents a cadence — At least one enabled agent has no governor cadence, so it cannot be kicked automatically while the hive is quiet. (signals: mode=IDLE, no_cadence_agents=1)
   • Widen HIVE_REPOS — The governor's actionable backlog is shallow in a low-pressure mode; adding repositories can feed more work to the hive. (signals: mode=IDLE, repo_count=1, governor_queue_total=1)

   Findings: 10

   💡 Showing top 10 findings (by severity). 434 more exist. Set governor.advisory.show_all: true to see all.

   Severity	Count
   🔴 critical	1
   🟠 high	9

   🔴 CRITICAL (1)

   • [infrastructure] Quality lane has no write credential: gh returns 401 Bad credentials on every REST and GraphQL call (file path not found at analyzed commit — finding may be outdated) ⚠️ (not re-reported within the staleness window — still open, but not recently verified) quality

     Every gh invocation this session failed with HTTP 401 Bad credentials: 'gh api repos/Automation workflows must validate and format what they generate before committing #755', 'gh api repos/cncf/endusers', 'gh api rate_limit', and 'gh issue view 755 --json ...' (the last against api.github.com/graphql). Retried across ~10 minutes; not transient. Per policy the agent did not look for or substitute any token. Consequence: no issue could be filed, no PR opened, and issue Automation workflows must validate and format what they generate before committing #755's body and merged PR test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758's diff could not be read (the public web page also returned 'You cannot perform that action at this time'). Read paths that do NOT use the App token still work: anonymous 'git clone https://github.com/cncf/endusers' succeeded, which is how this turn's analysis was done. Operator action needed: re-mint or re-install the contributor-tier GitHub App token for the quality lane.

   🟠 HIGH (9)

   • [advisory] Duplicated GitHub pagination/same-origin-guard logic in collect-metrics.mjs and collect-launch-metrics.mjs cncf/endusers#1372 architect
   • [advisory] reportAndExit() drops a long validator report when stderr is a pipe: console.error is async on POSIX and process.exit() does not flush scripts/lib/validate-utils.mjs quality
   • [coverage-gap] tests/helpers-jsx.mjs pre-22.15 register() fallback has zero unit coverage tests/helpers-jsx.mjs quality

     Unit evidence: 'npm run test:unit:coverage' (node v26.10.0, TZ=UTC) run locally 2026-10-08 at cncf/endusers main rev 0a68e5e reports tests/helpers-jsx.mjs at 95.35% lines / 87.50% regions, uncovered lines 31-32 and uncovered region start 30 -- exactly the 'else { register(HOOKS_URL); }' arm and nothing else. End-to-end evidence: not applicable; this is unit-test infrastructure, not a site path. Priority 1: covered by neither unit nor end-to-end tests. package.json pins engines.node to 22.x and registerHooks landed in 22.15, so the fallback is live code for supported Node 22.0-22.14, but unreachable in-process because CI runs latest 22.x. Issue [quality] tests/helpers-jsx.mjs: the pre-22.15 register() fallback has no coverage #1220.

   • [coverage-gap] tests/tools/e2e-coverage-builds.mjs was unimportable, so --require-source-files failed PR test(e2e): give each fixture overlay directory its own coverage build #1203 tests/tools/e2e-coverage-builds.mjs quality

     Unit evidence: 'npm run test:unit:coverage:check' (TZ=UTC node tests/tools/coverage-report.mjs --check 99 --check-source 100 --check-regions 95 --check-source-regions 99 --check-source-file-regions 97 --require-source-files, node v26.10.0) run locally 2026-10-08 on PR branch quality/test-e2e-named-fixture-builds at a23040d exited 1 with '1 source file(s) were never measured ... tests/tools/e2e-coverage-builds.mjs'. Same failure on CI run https://github.com/cncf/endusers/actions/runs/37774018155/job/113300258703 (Validate repository). Cause: the file was added as a bare top-level script that calls main() at module scope, so nothing could import it and no coverage record named it. E2E evidence: not applicable -- this is the unit coverage gate's own file-set floor, not a runtime code path. Fixed on the same branch at a9d8fd2: entrypoint-guard shape (export buildCommand/main, run only when process entrypoint) plus tests/e2e-coverage-builds.test.mjs; the file now reports 100.00% lines / 100.00% regions and the gate exits 0.

   • [missing-workflow] Four automation workflows force-push a fixed PR branch with no concurrency group, so overlapping runs race one ref .github/workflows/refresh-radar-reports.yml quality

     At cncf/endusers main 593b9fe, four workflows run peter-evans/create-pull-request with a branch: they name themselves, and none declares a concurrency group: refresh-radar-reports.yml (automation/refresh-radar-reports), refresh-community-people.yml (automation/refresh-community-people), import-architectures.yml (automation/import-architectures) and architecture-submission.yml (automation/architecture-issue-${{ github.event.issue.number }}). Mechanism verified in the action's source, not assumed: src/create-pull-request.ts pushes --force-with-lease branch:refs/heads/branch, and with delete-branch: true runs push --delete --force on that same ref once the branch stops differing from base. So two overlapping runs contend for one ref: the loser's --force-with-lease fails on stale info (a hard run failure, not silent data loss), and one run's no-diff cleanup can delete the ref the other run just opened a PR from. Overlap is trivially reachable: import-architectures is workflow_dispatch-only (press Run workflow twice), and the two refresh workflows are schedule+workflow_dispatch with 15-minute timeouts. Checked that no existing contract covers it: tests/ci-concurrency.test.mjs gates PR-triggered workflows only and says so in its header ('A new PR-triggered workflow can be added today with no concurrency block at all and the suite stays green'); ci-supply-chain covers pinning/permissions/runners/timeouts; automation-workflow-ordering covers step ordering. The action's own README and docs/concepts-guidelines.md do not mention concurrency, so this is argued from the push mechanics rather than from vendor guidance. Fix is one deliverable at four sites plus a contract test extension to tests/ci-concurrency.test.mjs (new scanners racingBranchWorkflows/pullRequestBranches/expressionsIn/isPerEvent, 6 new tests). Verified locally at 593b9fe: with both halves applied 'npm run test:unit' is 2092 tests / 0 failures and prettier is clean; with the workflow half reverted the new contract fails naming exactly those four files. Not PR-able by this agent: the workflow half is under .github/workflows/ which the contributor-tier App token cannot push, and the test half is red on its own, so the two cannot be split. Unit evidence: npm run test:unit (node v26.10.0, TZ=UTC, SWC_NATIVE_BINDING_CACHE=/tmp/swc-cache) run locally 2026-10-08 at 593b9fe. End-to-end evidence: not applicable; workflow definitions are not exercised by the Playwright suite.

   • [regression-risk] Root .npmrc ignore-scripts=true (the build(security): stop running dependency lifecycle scripts on install #1317 supply-chain control) has zero test coverage .npmrc quality

     PR build(security): stop running dependency lifecycle scripts on install #1317 (merged 92cede9, 2026-10-11) added a root .npmrc setting ignore-scripts=true to stop npm ci executing preinstall/install/postinstall/prepare from 1490 resolved packages in jobs holding a write-scoped GITHUB_TOKEN. Nothing reads the control back: grep -rn 'npmrc|ignore-scripts' over tests/ and scripts/ returns zero matches at 92cede9. Deleting .npmrc, flipping the value, adding a second .npmrc under a subdirectory, or passing --foreground-scripts on an install step all leave every workflow green. Unit evidence: TZ=UTC node --test over tests/ at 92cede9 (node v26.10.0, SWC_NATIVE_BINDING_CACHE set to a clean root) = 2379 pass / 0 fail, and no test names .npmrc. Not a coverage-gap: the control is a config key with no executable region, so no coverprofile can show it dark.

   • [regression-risk] reportAndExit() truncates validator error reports through a pipe: process.exit(1) at validate-utils.mjs:40 discards undrained stderr scripts/lib/validate-utils.mjs quality

     console.error() is asynchronous when stderr is a pipe (Node, 'A note on process I/O') and process.exit(1) does not flush it, so the tail of a long report from any of the 12 validate-*.mjs scripts can be lost. Fixed by writing each report to stderr's fd with fs.writeSync() in PR fix(validate-utils): write the error report to stderr synchronously so process.exit cannot truncate it #1293 (issue 1286). Verified at cncf/endusers main 4184f33 with 'SWC_NATIVE_BINDING_CACHE=/tmp/swc-cache npm run -s test:unit:coverage:check' (node v26.10.0, TZ=UTC, run locally 2026-10-10): 2324 tests pass, src files 100.00% lines / 100.00% regions, scripts/lib/validate-utils.mjs and tests/validate-utils.test.mjs both 100.00/100.00. process.exitCode=1 was rejected because every validator prints a 'Validated N ...' line after reportAndExit().

   • [test-infrastructure] ci.yml's Playwright trace upload contract is untested: narrowing it to if: failure() discards every flaky-spec trace while the suite stays green .github/workflows/ci.yml quality

     playwright.config.js sets retries:1 and trace:'retain-on-failure' in CI, so a spec that fails then passes on retry exits the e2e job green. The trace of the failed first attempt is the only record, and it survives only because ci.yml's 'Upload Playwright traces' step is guarded by if: ${{ !cancelled() }} ([quality] CI discards the traces of flaky Playwright runs: retries:1 exits 0, so the if: failure() trace upload never fires #1179) rather than if: failure(). No test reads that condition: tests/playwright-config.test.mjs pins retries/trace but never reads a workflow; tests/ci-playwright-setup.test.mjs reads workflows only for the browser install and its cache; tests/ci-gating-jobs.test.mjs checks continue-on-error, which a discarded artifact is not. Mutation-verified at main fb75c1a: rewriting that one condition to if: failure() leaves the entire unit suite green. Evidence: 'TZ=UTC node --test' run locally 2026-10-12 at cncf/endusers main rev fb75c1a, node v26.10.0. Not a coverage-gap: unit coverage of src+scripts is 100.00% lines / 100.00% regions ('npm run test:unit:coverage:check', exit 0, same rev), and e2e coverage is 2099/2099 lines, 641/659 regions (CI run 38182984387-1, artifact 11718925360, head fb75c1a) with all 18 zero-regions documented as the [quality] the e2e region union never credits a guard arm taken only in a sibling fixture build #1256 cross-build union residual in tests/e2e-coverage-gate.test.mjs.

   • [test-infrastructure] ci.yml's unit coverage gate loses its exit code if 'shell: bash -o pipefail {0}' is removed; no test sees it .github/workflows/ci.yml quality

     ci.yml#validate runs 'npm run test:unit:coverage:check | tee coverage-summary.txt' with 'shell: bash -o pipefail {0}'. Per GitHub workflow-syntax docs, -o pipefail is applied only for 'shell: bash'; a custom template string takes full control, and the no-shell default is 'bash -e {0}'. So that one line is the sole carrier of the gate's exit code: delete it and the step exits with tee's status (0), the unit suite and all five coverage thresholds print their failure and the job reports success. Verified by mutation at cncf/endusers main 593b9fe: with the shell: line deleted, 'npm run test:unit:coverage:check' (node v26.10.0, TZ=UTC, local) is still exit 0 and the whole suite green. Not seen by ci-gating-jobs.test.mjs (guards continue-on-error only), coverage-gate-thresholds.test.mjs (pins values + that the command is run; both survive a discarded exit code) or workflow-scripts.test.mjs (asks only whether a command is run). Repo-wide scan finds two real pipelines in run: steps; the other, create-milestones.yml#create-milestones, is covered by an in-body 'set -euo pipefail'. Issue [quality] nothing stops ci.yml's unit coverage gate from losing its pipefail #1224; hold-gated PR test(ci): pin pipefail on every piped run step #1225 adds tests/ci-pipeline-exit-codes.test.mjs. Not a coverage-gap: no source line is unexercised, the gap is that a CI contract is unpinned.

   ☑️ Recently Closed — Fix Not Verified (10)

   Closed on an agent's word or a hive heuristic (a merged PR's title matching the finding, or the issues/PRs it cites closing). The hive did not re-check the condition, so it may still hold.

   • CI health sweep 2026-10-12: all lanes green, no actionable findings run-list-2026-10-12 ci-maintainer — closed Oct 13 (no evidence recorded), fix not verified
   • Security sweep 2026-10-12 (fortieth pass) cncf/endusers 5a61d66: CLEAN, no new finding, no issue/PR opened. REAPED 2 beads (9e4f950e-98d, 9662892f-4b7): their stated blockers cleared this cycle - issue 1333 CLOSED by merged PR 1334 (eb75a9b) and issue 1338 CLOSED by merged PR 1339 (029d06d); both merged fixes verified in-tree (STYLE_ATTRIBUTE / 'string style attribute' report at mdx-active-content.mjs:89,210; devcontainer Features now ghcr.io/devcontainers/features/node:2.1.1 + github-cli:1.1.3, exact pins) and tests/mdx-active-content.test.mjs passes. HEAD moved fb75c1a->5a61d66 (18 commits), so the delta was the scan target. NEW ground probed and REFUTED this pass: (a) action-pin AUTHENTICITY re-verified after 5be2113 'Bump the actions group with 4 updates' - all 6 distinct pins resolved against the upstream tag named in their trailing comment via /git/ref/tags with annotated-tag dereference, zero drift: setup-node v7.1.0=949feb2, upload-artifact v7.0.2=cf430e0, codeql-action v4.38.3=24c5418, checkout v7.0.1=3d3c42e, peter-evans/create-pull-request v8.1.1=5f6978f, cache v6.1.0=55cc834; (b) the NEW .github/dependabot.yml names labels 'dependencies' and 'javascript' - both verified present via /repos/cncf/endusers/labels, so no Dependabot run fails on a missing label, which is the failure mode its own comment warns about; (c) SECURITY.md:28-29's new claim that CodeQL scans the GitHub Actions workflows (the 'actions' language) verified TRUE against codeql.yml matrix language ['javascript-typescript','actions'] with .github/workflows/** in both push and pull_request path filters - doc and workflow agree; (d) scripts/lib/architecture-pages.mjs (named in no prior bead) read end to end: walk() uses Dirent lstat semantics so a symlinked DIRECTORY is false for isDirectory() and lands in the isSymbolicLink branch, reported as irregular and never followed, closing the published-but-ungated path its comment describes; RESERVED_PAGE_IDS={'index'} is lowercased before comparison so no importer id can overwrite the exempt hand-authored index.md; (e) scripts/import-architecture-issue.mjs (issues:labeled trigger, attacker-supplied issue body) traced end to end - every BODY_SECTION value passes escapeMdx(), project cards go through jsxElement()/artworkPath()/isCncfProjectHref(), front-matter title/sidebar_label are JSON.stringify'd, and the only expression interpolated into architecture-submission.yml is github.event.issue.number (numeric) plus the slugified steps.import.outputs.id, never into a run block; (f) every child_process call site in scripts/ is execFileSync/spawnSync with an argv array, zero shell; zero eval/new Function; zero dangerouslySetInnerHTML or innerHTML in src/; (g) rsvg-convert runs only on bytes that already passed findActiveContent() post-edit re-verification, and svg-active-content.mjs fails closed on declared entities, so no XXE reaches librsvg. DEPENDENCIES: npm audit 28 high, programmatically enumerated to exactly ONE distinct advisory - GHSA-vfj7-8cjw-p6xm (braces) - which is allowlisted in SECURITY.md; check:audit green. SECRETS: clean, only ghp_example fixtures in tests/lib-github.test.mjs. COMMITTED SVGs: all static SVGs run through findActiveContent(), zero findings, zero parse failures. STOOD DOWN from scripts/collect-case-studies.mjs, scripts/collect-radar-reports.mjs, scripts/lib/cncf-wp-api.mjs (open hold-gated PR 1365) and CONTRIBUTING.md, tests/e2e-coverage-gate.test.mjs (open hold-gated PR 1363). sec-check — closed Oct 12 (no evidence recorded), fix not verified
   • endusers PR feat(events): add KubeCon NA 2026 end user talks schedule #1369: 3 failing checks are PR-local — .timezone contrast (emphasis-600→700) + collect-end-user-talks.mjs never measured; fix posted as comment (human PR, no push) #1369 scanner — closed Oct 12 (the issues/PRs it cites closed), fix not verified
   • cncf/endusers fb75c1a scanner sweep: 20 commits since 4184f33 reviewed (lifecycle-script install block, workflow serialisation, audit-gate staleness fail, manifest-src CSP, sync stderr, codeql actions matrix) — all ship with contract tests, no new findings; persist-credentials now clean repo-wide scanner — closed Oct 12 (no evidence recorded), fix not verified
   • SECURITY.md:28 stale post-#1309: says CodeQL scans only JS/TS source; actions-language workflow analysis undocumented — filed as issue [guide] SECURITY.md says CodeQL scans only the JavaScript/TypeScript source — since #1309 it also analyses the Actions workflows #1346 https://github.com/cncf/endusers/issues/1346 guide — closed Oct 12 (no evidence recorded), fix not verified
   • Security sweep 2026-10-12 (thirty-ninth pass) cncf/endusers eb75a9b: CLEAN - no new finding, no issue or PR opened. REAPED 2 findings now resolved upstream: issue 1333 / PR 1334 (mdx-active-content case-sensitive element allowlist + string style attribute) MERGED, and issue 1338 / PR 1339 (devcontainer Features pinned to exact versions, devcontainers Dependabot ecosystem added) MERGED; both beads closed along with four superseded sweep beads. Dependency posture unchanged: npm audit reports 28 high, every one tracing solely to allowlisted GHSA-vfj7-8cjw-p6xm (braces), and the no-upstream-fix premise still holds. Supply chain re-verified at the new HEAD: zero unpinned 'uses:' across all 10 workflows and .github/actions, every workflow carries a top-level least-privilege permissions block, all 12 checkout steps set persist-credentials: false, and .github/dependabot.yml now covers all three ecosystems (github-actions, devcontainers, npm) so no pinned surface is left without a refresher. NEW ground probed and REFUTED this pass: (a) the just-merged mdx-active-content.mjs fix re-fuzzed with 20 adversarial MDX payloads at eb75a9b - every executable or off-origin form was caught (uppercase ONCLICK, namespaced xlink:href javascript:, string and object style, case-variant, member-expression <b.c>, bare /, concatenated-string attribute expression, \u-escaped protocol-relative logo, http:evil.example bare-authority logo, unresolved-then-resolved image reference definitions, data:text/html image, ESM statement, flow expression); the only three non-catches are correct by design (on-click is not a React handler, data-x={"a"} is an inert string literal, and a boolean attribute has no value); (b) uri-safety.mjs remains the single source of truth both the MDX and SVG gates call, so no scheme is accepted by one gate and refused by the other; (c) architecture-pages.mjs REPO_AUTHORED_PAGES exemption is still backed by RESERVED_PAGE_IDS, so no imported slug can land on the one unscanned page; (d) CSP re-read in full at HEAD - base-uri, object-src, frame-src, media-src, connect-src, font-src, manifest-src, form-action, script-src, style-src and img-src are all named with no default-src, and the two remaining unnamed directives (worker-src, child-src) inherit from script-src/frame-src, so there is no fallback gap; (e) project-assets.mjs artworkPath still pins host+repo to cncf/artwork on main|master over https and refuses SHA refs, traversal and empty segments; (f) dependabot/alerts and repo security_and_analysis remain 403 at the contributor tier, so GitHub-side scanner settings could not be verified either way and no claim is made about them. Occupied ground respected: open hold-gated PRs 1355 (SECURITY.md) and 1348 (tests/architecture-submission-contract.test.mjs) were inspected and no file touched or probed here overlaps them. sec-check — closed Oct 12 (no evidence recorded), fix not verified
   • Security sweep 2026-10-12 (thirty-eighth pass) cncf/endusers fb75c1a: CLEAN — no new finding. Reaped nothing: issues 1333 and 1338 both still OPEN with their hold-gated PRs 1334/1339 awaiting human review, so neither bead is resolvable. npm audit 28 high, every one tracing solely to allowlisted GHSA-vfj7-8cjw-p6xm; check:audit green; braces no-upstream-fix premise RE-VERIFIED this pass — 'npm view braces version' returns 3.0.3, the exact version the tree resolves (micromatch 4.0.8 -> braces 3.0.3 deduped), so no fixed release exists to bump to. NEW ground probed and REFUTED this pass, none of it in any prior bead: (a) action-pin AUTHENTICITY, not just pin presence — all 10 pinned SHAs resolved against the upstream tag named in their trailing comment via /git/ref/tags and, for the annotated tag, /git/tags dereference; every pin matches its tag's commit exactly (actions/cache v6.1.0, checkout v7.0.1, configure-pages v6.0.0, deploy-pages v5.0.1, setup-node v7.0.0, upload-artifact v7.0.1, upload-pages-artifact v5.0.0, peter-evans/create-pull-request v8.1.1, and github/codeql-action init+analyze v4.38.2 whose annotated tag 8858526 dereferences to the pinned 2892aa5) — zero drift, zero mislabelled pin; (b) npx-fetched toolchain — every package invoked via npx in package.json scripts (prettier, cspell, markdown-link-check, markdownlint-cli, markdownlint, npm-check-updates) is declared in devDependencies and therefore resolves from node_modules, so no unpinned registry fetch executes in CI; (c) data-file/validator completeness audit — all 8 data/.json files imported by src/ (awards, case-studies, community-groups, community-people, members, metrics, projects-born, radar-reports) have a matching validate: step in BOTH ci.yml and deploy-gh-pages.yml; no component consumes an ungated data file; (d) CommunityPeople renders person.image into a raw with no component-level gate, but validate-community-people.mjs:105 holds every image to profileImageUrl()'s https+host gate and fetch-community-people.mjs:192 drops upstream candidates that fail it, so the raw render is backed; (e) tabnabbing sweep — all 25 target=_blank anchors in src/ carry rel=noreferrer or rel=noopener noreferrer, none bare; (f) CSP re-read in full: base-uri 'self' and form-action 'self' are both present alongside the fetch directives, closing the two non-fetch directives that have no default-src fallback; (g) credentialed pagination SSRF — githubAll() in BOTH collect-metrics.mjs:310 and collect-launch-metrics.mjs:135 pins Link rel=next to the first request's origin via sameOriginNext(), so a hostile Link header cannot walk the Authorization header off-origin; (h) jsx-attributes.mjs cannot be broken out of: names/elements are identifier-gated and values are emitted as expression-form JSON string literals; (i) mdx-escape.mjs escapes block-initial import/export with the correct 0-3 space indent allowance, closing MDX ESM injection; (j) mirrorArtworkUrls write path re-checked end to end — artworkPath pins host+repo+branch ref and rejects traversal, artworkMirrorName enforces a 7-entry image extension allowlist so no markup/script extension can land in static/, lstat refuses symlink destinations, and SVGs are stripped of active content and refused on remote references; (k) all 12 checkout steps across all 10 workflows set persist-credentials: false; (l) repo-level security_and_analysis and the dependabot/alerts API are both unreadable at the contributor tier (403), so GitHub-side scanner settings could not be verified either way — NOT filed, as asserting a gap there would be unverified. No issue or PR opened: no new finding, and filing one would duplicate occupied ground. sec-check — closed Oct 12 (no evidence recorded), fix not verified
   • endusers#1355 (docs lane, held): Lint repository red on head 757a6d8 — prettier reflow drift in PR-edited SECURITY.md, PR-local FIX_DIFF; cannot push docs branch, exact fix diff commented on PR cncf/endusers#1355 run 38256490241 ci-maintainer — closed Oct 12 (the issues/PRs it cites closed), fix not verified
   • tmp-probe-ignore quality — closed Oct 12 (no evidence recorded), fix not verified
   • Security sweep 2026-10-12 (thirty-seventh pass) cncf/endusers fb75c1a: 1 low finding (issue 1338 / PR 1339, devcontainer Feature pinning). npm audit 28 high, all tracing solely to allowlisted GHSA-vfj7-8cjw-p6xm. REFUTED this pass, not filed: (a) package-lock.json — every resolved URL is registry.npmjs.org and zero entries lack an integrity hash; (b) all 10 actions SHA-pinned, every workflow has a least-privilege top-level permissions block, only numeric github.event.issue.number interpolated and never into a run: block; (c) pr-queue-hygiene.mjs marker trust model sound — markers honoured only from user.type==='Bot' on an allowlist, future timestamps rejected, scanning continues past a spoofed marker, and its HOLD_LABELS set matches GOVERNANCE.md:48 exactly; (d) renderProjectCards() fallback href independently re-confirmed unexploitable — the literal https://www.cncf.io/projects/ prefix terminates the authority so no header= character can change origin; (e) artworkPath() refuses SHA refs, non-https, traversal and empty segments, closing the fork-network raw.githubusercontent.com path; (f) validate-awards.mjs gates verifiedAgainst/announcementUrl/caseStudyUrl/talkUrl as https and confines logo to static/img/awards/; (g) deploy-gh-pages.yml runs all 14 validators, so the automation-PR path that bypasses ci.yml still fails closed before publish; (h) CSP names every fetch directive with no default-src fallback gap; (i) no tracked secrets, no eval/innerHTML/dangerouslySetInnerHTML sink anywhere in src/ or scripts/ sec-check — closed Oct 12 (no evidence recorded), fix not verified
   • …plus 46 more closed without a verified fix in the last 48h, collapsed so the open findings above stay readable

   ---

   Analyzed at cncf/endusers@f5586b0fb96a (branch main) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked ⚠️ were computed at an older commit and have NOT been re-verified here.
3. mrbobbytables

   closed this as completedon Sep 24, 2026
4. hivecommons-hive

   reopened this on Sep 24, 2026
5. mrbobbytables

   closed this as completedon Sep 25, 2026
6. hivecommons-hive

   reopened this on Oct 1, 2026
7. mrbobbytables

   closed this as completedon Oct 1, 2026
8. hivecommons-hive

   reopened this on Oct 5, 2026