MLE-31392: [HIGH] BDSA-2026-21558 in linkify-it v5.0.1 (MarkLogic-DevExp-nodeapi) - #1102
Conversation
There was a problem hiding this comment.
Pull request overview
This PR remediates vulnerability BDSA-2026-21558 by pinning the transitive dependency linkify-it to the patched version 5.0.2 via npm overrides, ensuring the lockfile resolves to the fixed artifact.
Changes:
- Added an
overridesentry to forcelinkify-it@5.0.2. - Regenerated
package-lock.jsonsonode_modules/linkify-itresolves to5.0.2.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Pins linkify-it to 5.0.2 via overrides to remediate the advisory with minimal dependency churn. |
| package-lock.json | Updates the resolved linkify-it package entry to 5.0.2 to reflect the override and remove 5.0.1 resolution. |
|
One alternative worth considering: instead of overriding linkify-it directly, we could upgrade the markdown-it override to 14.3.0: npm list linkify-it dependencies of markdown-it@14.3.0 markdown-it@14.3.0 ships with linkify-it@5.0.2 as its designed dependency. We already have a markdown-it override in place, so it would just be a version bump there rather than adding a new linkify-it override. |
f6c0204 to
a9c5091
Compare
Title:
MLE-31392: remediate BDSA-2026-21558 by pinning linkify-it to 5.0.2
Description:
This PR remediates the high-severity vulnerability BDSA-2026-21558 in linkify-it (DoS via algorithmic complexity) for the develop branch of MarkLogic-DevExp-nodeapi.
What changed:
Added an override to force linkify-it 5.0.2 in package.json.
Regenerated the lockfile so linkify-it resolves to 5.0.2 in package-lock.json.
Why this approach:
5.0.2 is the recommended patched version for this advisory.
Current transitive dependents resolve linkify-it on the 5.x line, so pinning to 5.0.2 is the lowest-risk fix.
Avoids broader dependency changes in this security patch PR.
Validation performed:
Confirmed the linkify-it entry resolves to 5.0.2 in package-lock.json.
Confirmed no linkify-it 5.0.1 lockfile tarball entry remains for node_modules/linkify-it.
Regenerated lockfile successfully with npm install --package-lock-only --ignore-scripts (using npm_config_engine_strict=false due local Node engine mismatch).