MLE-31392: [HIGH] BDSA-2026-21558 in linkify-it v5.0.1 (MarkLogic-DevExp-nodeapi)

[ngodugu-marklogic]

Title:
MLE-31392: remediate BDSA-2026-21558 by pinning linkify-it to 5.0.2

Description:
This PR remediates the high-severity vulnerability BDSA-2026-21558 in linkify-it (DoS via algorithmic complexity) for the develop branch of MarkLogic-DevExp-nodeapi.

What changed:
Added an override to force linkify-it 5.0.2 in package.json.
Regenerated the lockfile so linkify-it resolves to 5.0.2 in package-lock.json.

Why this approach:
5.0.2 is the recommended patched version for this advisory.
Current transitive dependents resolve linkify-it on the 5.x line, so pinning to 5.0.2 is the lowest-risk fix.
Avoids broader dependency changes in this security patch PR.

Validation performed:
Confirmed the linkify-it entry resolves to 5.0.2 in package-lock.json.
Confirmed no linkify-it 5.0.1 lockfile tarball entry remains for node_modules/linkify-it.
Regenerated lockfile successfully with npm install --package-lock-only --ignore-scripts (using npm_config_engine_strict=false due local Node engine mismatch).

[Copilot]

Pull request overview

This PR remediates vulnerability BDSA-2026-21558 by pinning the transitive dependency linkify-it to the patched version 5.0.2 via npm overrides, ensuring the lockfile resolves to the fixed artifact.

Changes:

• Added an overrides entry to force linkify-it@5.0.2.
• Regenerated package-lock.json so node_modules/linkify-it resolves to 5.0.2.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Pins linkify-it to 5.0.2 via overrides to remediate the advisory with minimal dependency churn.
package-lock.json	Updates the resolved linkify-it package entry to 5.0.2 to reflect the override and remove 5.0.1 resolution.

[RitaChen609]

One alternative worth considering: instead of overriding linkify-it directly, we could upgrade the markdown-it override to 14.3.0:

npm list linkify-it
marklogic@4.1.0 C:\Users\ritac\marklogic_workspace\marklogic-devexp\node-client-api
└─┬ jsdoc@4.0.5
└─┬ markdown-it@14.2.0 overridden
└── linkify-it@5.0.1

dependencies of markdown-it@14.3.0
argparse: ^2.0.1, entities: ^4.5.0, linkify-it: ^5.0.2, mdurl: ^2.0.0, punycode.js: ^2.3.1, uc.micro: ^2.1.0

markdown-it@14.3.0 ships with linkify-it@5.0.2 as its designed dependency.

We already have a markdown-it override in place, so it would just be a version bump there rather than adding a new linkify-it override.