v5.165.0

Added

• Label-driven approval via triage/accepted on Prow-style repos (#11313). Strictly opt-in per repository (project.repo_policies[].label_driven: true, now also editable from Settings → Repos): a trusted addition of an approval label (default triage/accepted, project.label_driven_approval_labels / per-repo override) releases a parked issue exactly like /hive approve — Hive-added needs-human/needs-decision/needs-direction removed, approved-direction added, one reply — and counts as human sign-off for pr_self_authorization, with no /hive comment required. Only the latest labeled event's actor is checked: an allowlisted bot (project.label_driven_trusted_bots), a collaborator whose role_name is triage/write/maintain/admin, or a public org member when project.label_driven_trust_org_members is on (default, Prow's rule); anything else or an unreadable timeline fails closed. On label-driven repos /hive approve|decision also accept the GitHub triage role and remove Hive-added park labels only; person-added park labels and hold/do-not-merge still park. Globally, an issues labeled/unlabeled webhook now lets the un-park sweep run within ~30 s instead of the 5-minute poll, and once-only reply markers are honoured only when the hive's own identity wrote them. Repos without label_driven are otherwise unchanged.

---

SBOMs: SPDX JSON, generated by Syft against the linux/amd64 image digest, attached below for hive, hive-contributor, and hive-hub. They cover linux/amd64 only — see releases.md for why linux/arm64 is not scanned separately.

NOTICE: third-party license attribution for the Go module dependencies compiled into these images, attached below. Does not cover base-image OS packages or the Node.js/tmux layers built from source — see releases.md for the exact boundary.