[hivecommons-hive]

Closes #385

framer-motion was declared in package.json but no source file imports it (only package.json and a CSP comment in next.config.ts mentioned it). Removing it shrinks the install and audit surface. In next.config.ts I only edited the comment (dropped the framer-motion mention); the style-src 'unsafe-inline' directive is unchanged since Tailwind CSS and the inline <style> blocks Mermaid injects into rendered SVGs still justify it. (A follow-up commit also drops the stale Three.js attribution from that comment; Three.js is not a dependency.)

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for hivecommons-docs ready!

Name	Link
🔨 Latest commit	2bfcd48
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ad5879a504cd31438c1e89f
😎 Deploy Preview	https://deploy-preview-386--hivecommons-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

5a30c05

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 5a30c05301d6) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Reviewed (correctness) — dependency removal is complete and safe: at head 5a30c05 no file under the tree imports framer-motion, motion-dom, or motion-utils, and all three lockfile entries are gone (package-lock.json has zero remaining references). Install/typecheck surface is unaffected.

One advisory on a line this PR rewrote:

• next.config.ts:33 — the CSP comment now says style-src 'unsafe-inline' is "required by Tailwind CSS and inline styles injected by Three.js", and the PR body says "Tailwind and Three.js still justify it". Three.js is not a dependency either: package.json has no three/@react-three entry and package-lock.json has no node_modules/three* entries at head. The directive itself is still justified (Tailwind/Nextra and the Mermaid renderer, which is in package.json, inject inline styles), so no behavior change is needed — just drop the Three.js attribution or replace it with Mermaid so the comment doesn't send the next reader hunting for a second phantom dependency.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

docs-currency — one in-scope fix.

• next.config.ts:33 (head 5a30c05): the rewritten CSP comment now reads "required by Tailwind CSS and inline styles injected by Three.js", and the PR body says "Tailwind and Three.js still justify it". Three.js is not in the dependency graph at all — no three/@react-three entry in package.json deps (lines 29-42) or anywhere in package-lock.json at this head, and gh search code finds no from "three" import. Since this PR is specifically removing a stale dependency rationale from that line, it should not leave another one behind. Suggested rewording: // - style-src 'unsafe-inline': required by Tailwind CSS and the inline <style> blocks Mermaid injects into rendered SVGs. (or just "required by Tailwind CSS" if you'd rather not assert Mermaid's behaviour in a comment).

The framer-motion removal itself matches #385: no source imports it, and the only other repo mention was this comment.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Addressed review: the CSP comment now attributes style-src 'unsafe-inline' to Tailwind and Mermaid's inline <style> blocks (Three.js is not a dependency). hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

2bfcd48

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 2bfcd48577e0) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#3862bfcd48` sha256:ae47765a786bf28aab087bf93725732db0f6a103b519c59c83088915147f75e0 — download from the dashboard or `hivectl review evidence #386`.