MLE-31646: [MEDIUM] BDSA-2026-24060 in PostCSS v8.5.15 (MarkLogic-DevExp-nodeapi)

[ngodugu-marklogic]

Summary

This PR remediates vulnerability BDSA-2026-24060 (PostCSS path traversal / information disclosure) reported in Black Duck for project MarkLogic-DevExp-nodeapi on branch develop.

The vulnerable transitive version was PostCSS 8.5.15.
This PR enforces PostCSS 8.5.23 (patched) using npm overrides.

What Changed

1. Added an override in package.json to force: postcss: 8.5.23
2. Regenerated package-lock.json so dependency resolution reflects the override.
3. Verified lockfile now resolves PostCSS to 8.5.23 in package-lock.json.

Why This Approach

1. PostCSS is transitive (via sanitize-html), not a direct top-level dependency.
2. Upgrading sanitize-html alone did not guarantee a patched PostCSS resolution in this repo.
3. Override-based pinning provides deterministic remediation with minimal functional impact.

Security Impact

Fixes Black Duck finding: Vulnerability ID: BDSA-2026-24060
Severity: Medium
CVSS: 6.5
Moves PostCSS from vulnerable 8.5.15 to patched 8.5.23.

Validation

Confirmed override entry exists in package.json.
Confirmed resolved version is PostCSS 8.5.23 in package-lock.json:4106.

Risk / Compatibility

Low risk: change is limited to dependency resolution for a transitive package.
Lockfile includes expected transitive metadata updates associated with the new PostCSS package.

[Copilot]

Pull request overview

This PR remediates Black Duck vulnerability BDSA-2026-24060 by forcing a patched PostCSS 8.5.23 resolution via npm overrides, then regenerating the lockfile to reflect the new transitive graph.

Changes:

• Added an npm overrides entry pinning postcss to 8.5.23.
• Regenerated package-lock.json to resolve postcss (and related transitive deps like nanoid) to patched versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds postcss to overrides to deterministically force the patched version.
package-lock.json	Updates resolved dependency graph to use postcss@8.5.23 (and associated transitive updates).

[jonmille]

This package is not available in harness yet since it was published 8/3, causing the Jenkins Pipeline to fail, and must be published for 14 days before getting into harness registry

[jonmille]

Version 3.3.16 was released on 7/12 and currently has no vulnerabilities reported in Black Duck

[RitaChen609]

8.5.23 was published on 24 Jul, 2026. which is not available on Harness yet.

[jonmille]

8.5.20 was released on 7/19 and has no vulnerabilities in Black Duck