[SCA] Remediate vulnerable dependencies — SECINV-136

[rampostman]

SECINV-136 — patch/minor SCA hygiene mandate
Automated dependency remediation scoped to patch/minor-fixable High/Critical findings
(direct + transitive). Majors, no-fix, and non-SCA tracks are surfaced for humans, not
auto-fixed. Generated by fix-sca-vulns.

---

SCA Remediation Report — postman-code-generators (secinv-136 mandate) — 2026-07-24

Summary

Remediated all in-scope patch/minor High-severity SCA findings surfaced by the Wiz
secinv-136_sca_scan policy (transitive-inclusive). Three vulnerable libraries across
9 finding-instances (root project + per-codegen manifests) were driven to 0.

• Wiz verdict: WARN_BY_POLICY (pre) → PASSED_BY_POLICY (post)
• In-scope High findings: 9 finding-instances / 3 packages → 0
• Frozen install gate (npm ci --legacy-peer-deps): ✅ green
• Deprecation gate on touched versions: ✅ none deprecated
• Toolchain: Node 18.20.8 / npm 10.9.8 (repo engines: node>=18; CI uses Node 20)

Results

Package	Type	From	To	CVE	Severity	Notes
lodash	direct (minor)	4.17.21	4.18.1	CVE-2026-4800	HIGH (public exploit)	4.18.0 is a deprecated bad release → used 4.18.1
lodash	transitive (dedup)	4.17.21	4.18.1	CVE-2026-4800	HIGH	nested copies exact-pinned by postman-collection@5.0.0, newman, postman-runtime, postman-sandbox, postman-collection-transformer — deduped via $lodash override
brace-expansion	transitive (patch)	1.1.11	1.1.16	CVE-2026-13149	HIGH	override (parents declare ^1.1.7)
cross-spawn	transitive (patch)	7.0.3	7.0.6	CVE-2024-21538	HIGH	clean re-resolution of ^7.0.3 chain; 6.x line → 6.0.6

Fixes applied

Parent/direct bumps + overrides:

• Root package.json:
  • lodash direct dependency ^4.17.21 → ^4.18.1
  • overrides:
    • "lodash": "$lodash" — self-references the bumped direct dep; forces every nested lodash (5 copies exact-pinned at 4.17.21 by @postman-adjacent parents) to 4.18.1. Chosen over an unscoped literal (which triggers EOVERRIDE against a direct dep) and over version-scoped (which fails npm ci under exact-pinning parents).
    • "brace-expansion@1.1.11": "1.1.16"
• Codegen manifests (direct lodash declarers): dart-dio, kotlin-okhttp, nodejs-axios, rust-reqwest — exact pin 4.17.21 → 4.18.1.
• Codegen manifests (transitive lodash via postman-collection@5.0.0): http, nodejs-native, python-http.client — added per-codegen overrides: { "lodash": "4.18.1" } (these codegens ship no lockfile; the override forces the fixed version at deepinstall time).
• package-lock.json: cleanly regenerated (required for override application — incremental/npm update leaves stale nested nodes). lockfileVersion preserved at 3.
• cross-spawn: no override needed — the clean re-resolve of the ^7.0.3 chain lands on 7.0.6 (≥ fix 7.0.5); the unflagged 6.x line moved 6.0.5 → 6.0.6. (The still-present cross-spawn@4.0.2 under foreground-child was NOT flagged by Wiz and is out of scope.)

Install guardrail (separate commit): added .npmrc release-age gate (minimum-release-age=10080, @postman/* exempt).

Tier commits

1. chore(security): add install release-age guardrail (.npmrc)
2. [SCA] Remediate patch/minor SCA vulns (lodash, brace-expansion, cross-spawn) — 2026-07-24

Validation

• Frozen install npm ci --legacy-peer-deps exits 0 on the final tree
• No vulnerable versions remain in the lockfile (lodash 4.18.1 only; brace-expansion 1.1.16 only; cross-spawn 6.0.6/7.0.6, no 7.0.3)
• No deprecated version among touched packages
• Wiz re-scan: PASSED_BY_POLICY, 0 failing library findings
• Smoke test: lodash@4.18.1, cross-spawn, brace-expansion load & function
• Full multi-language CI test suite — deferred to PR CI (the suite spans 34 language variants requiring system-level toolchains: php, ruby, python, go, rust, etc.; impractical to baseline locally in an unattended run). The changes are dependency version bumps only (no source changes); CI on this PR is the authoritative functional gate.

Out of scope / needs-human

• Toolchain / release-age gate activation: the .npmrc release-age gate is honored by npm ≥ 11 only and is inert under this repo's npm 10 toolchain. Activating it requires standardizing on npm 11 (Node ≥ 20). Deferred because npm 11 rewrites this repo's lockfile format — a separate, deliberate change.
• cross-spawn@4.0.2 (under foreground-child, dev-tooling chain): technically within CVE-2024-21538's <6.0.6 range but not flagged by Wiz; left untouched (out of mandate scope). Would require a foreground-child major bump.
• No major-only upgrades, no-fix findings, or @postman/* exact-pin overrides were required in this run.
• No LICENSE / Software-Management findings were reported.

Wiz report

Pre-scan cloud event and post-scan PASSED_BY_POLICY verdict recorded in the run (Wiz secinv-136_sca_scan policy).