MLE-31764: [HIGH] BDSA-2026-24772 in nanoid v3.3.12 (MarkLogic-DevExp-nodeapi)

[ngodugu-marklogic]

PR Summary

This PR remediates BDSA-2026-24772 by updating transitive dependency resolution to a non-vulnerable nanoid release within the same major version, and aligns with BlackDuck guidance by updating sanitize-html to the recommended patch version.

What changed

1. Upgraded sanitize-html from ^2.17.6 to ^2.17.7 in package.json:76.
2. Added an explicit override for nanoid at 3.3.17 in package.json:102.
3. Regenerated lockfile entries to resolve:
   • nanoid 3.3.17 at package-lock.json:3744 and package-lock.json:3746
   • sanitize-html 2.17.7 at package-lock.json:4490 and package-lock.json:4492

Why

• Addresses the reported nanoid vulnerability without major-version changes.
• Follows BlackDuck’s direct recommendation path through sanitize-html 2.17.7.
• Ensures deterministic dependency resolution in the lockfile.

Risk and compatibility

• Low risk: patch-level dependency updates only, no application code changes.
• No major version bumps introduced.

Validation performed

1. Verified manifest updates in package.json.
2. Verified lockfile resolution to expected versions in package-lock.json.
3. Confirmed commit scope is limited to dependency manifests and lockfile.

Notes

• Local lockfile generation showed Node engine warnings due to local Node version being lower than repo requirement, but lockfile update completed successfully.

[Copilot]

Pull request overview

This PR remediates reported third-party vulnerabilities by updating dependency resolution: it upgrades sanitize-html to the recommended patch version and forces nanoid to a non-vulnerable release via npm overrides, with corresponding lockfile regeneration.

Changes:

• Upgraded sanitize-html from ^2.17.6 to ^2.17.7.
• Added an npm overrides entry pinning nanoid to 3.3.17.
• Regenerated package-lock.json to reflect updated resolved artifacts and integrity hashes.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps sanitize-html patch version and pins nanoid via overrides.
package-lock.json	Updates lockfile entries to resolve sanitize-html and nanoid to the intended versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.