MLE-31764: [HIGH] BDSA-2026-24772 in nanoid v3.3.12 (MarkLogic-DevExp-nodeapi)

[ngodugu-marklogic]

PR Summary

This PR remediates BDSA-2026-24772 by updating transitive dependency resolution to a non-vulnerable nanoid release within the same major version, and aligns with BlackDuck guidance by updating sanitize-html to the recommended patch version.

What changed

1. Upgraded sanitize-html from ^2.17.6 to ^2.17.7 in package.json:76.
2. Added an explicit override for nanoid at 3.3.17 in package.json:102.
3. Regenerated lockfile entries to resolve:
   • nanoid 3.3.17 at package-lock.json:3744 and package-lock.json:3746
   • sanitize-html 2.17.7 at package-lock.json:4490 and package-lock.json:4492

Why

• Addresses the reported nanoid vulnerability without major-version changes.
• Follows BlackDuck’s direct recommendation path through sanitize-html 2.17.7.
• Ensures deterministic dependency resolution in the lockfile.

Risk and compatibility

• Low risk: patch-level dependency updates only, no application code changes.
• No major version bumps introduced.

Validation performed

1. Verified manifest updates in package.json.
2. Verified lockfile resolution to expected versions in package-lock.json.
3. Confirmed commit scope is limited to dependency manifests and lockfile.

Notes

• Local lockfile generation showed Node engine warnings due to local Node version being lower than repo requirement, but lockfile update completed successfully.

[Copilot]

Pull request overview

This PR remediates reported third-party vulnerabilities by updating dependency resolution: it upgrades sanitize-html to the recommended patch version and forces nanoid to a non-vulnerable release via npm overrides, with corresponding lockfile regeneration.

Changes:

• Upgraded sanitize-html from ^2.17.6 to ^2.17.7.
• Added an npm overrides entry pinning nanoid to 3.3.17.
• Regenerated package-lock.json to reflect updated resolved artifacts and integrity hashes.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps sanitize-html patch version and pins nanoid via overrides.
package-lock.json	Updates lockfile entries to resolve sanitize-html and nanoid to the intended versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[RitaChen609]

@ngodugu-marklogic npm audit still reports the same vulnerability on nanoid@3.3.17

`PS C:\Users\ritac\marklogic_workspace\marklogic-devexp\node-client-api> npm list nanoid
marklogic@4.1.0 C:\Users\ritac\marklogic_workspace\marklogic-devexp\node-client-api
└─┬ sanitize-html@2.17.6
└─┬ postcss@8.5.23 overridden
└── nanoid@3.3.17 overridden

PS C:\Users\ritac\marklogic_workspace\marklogic-devexp\node-client-api> npm audit

npm audit report

nanoid <3.3.18
Severity: moderate
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition. - https://nvd.nist.gov/vuln/detail/CVE-2026-67213
fix available via npm audit fix
node_modules/nanoid
postcss
Depends on vulnerable versions of nanoid
node_modules/postcss
sanitize-html
Depends on vulnerable versions of postcss
node_modules/sanitize-html

3 moderate severity vulnerabilities`