[SCA] Remediate vulnerable dependencies — SECINV-136

[rampostman]

SECINV-136 — patch/minor SCA hygiene mandate. Automated dependency remediation scoped to
patch/minor-fixable High/Critical findings from the secinv-136_sca_scan Wiz policy. Draft PR —
do not merge without review.

---

SCA Remediation Report — openapi-to-postman (secinv-136 mandate) — 2026-07-24

Summary

Remediated both in-scope High-severity SCA findings via clean direct minor upgrades. No overrides
required, no code changes, no test regressions. Wiz re-scan verdict flipped to PASSED_BY_POLICY.

Results (distinct CVEs)

Metric	Before	After
In-scope High/Critical CVEs (patch/minor-fixable)	2	0
Net resolved		2
New CVEs introduced		0

Wiz policy verdict: secinv-136_sca_scan — WARN_BY_POLICY → PASSED_BY_POLICY.

Upgraded

Package	Type	From	To	CVE	Severity	Notes
lodash	direct dep (exact pin)	4.17.21	4.18.1	CVE-2026-4800	HIGH (public exploit)	Target 4.18.1, not 4.18.0 — 4.18.0 is deprecated ("Bad release. Please use lodash@4.17.21") and 4.17.21 is where the CVE lives. 4.18.1 (maintainer jdalton, published 2026-04-01, past the release-age gate) is the first clean fixed release.
js-yaml	direct dep (exact pin)	4.1.0	4.3.0	CVE-2026-59869	HIGH (public exploit)	Fixed version 4.3.0 (maintainer vitaly, published 2026-06-26, past the release-age gate).

Both were exact-pinned in package.json; upgrades applied with --save-exact to preserve pin style.

Tier commits

• [SCA][direct minor] Fix 2 packages — 2026-07-24 — lodash + js-yaml.

(No direct-patch, transitive, or parent-drop stages: both findings were direct minor bumps.)

Overrides kept

None. Both fixes are plain direct upgrades.

Out of scope / needs-human

• None. No major-only upgrades, no no-fix findings, no @postman/* pins, no License/Software-Management
  findings surfaced by the scan.

Validation

• Baseline captured (clean): build ✓, lint 0 errors, system 33 passing, unit 1719 passing / 3 pending / 0 failing.
• Post-fix tests: build ✓, lint 0 errors, system 33 passing, unit 1719 passing / 3 pending / 0 failing — no new failures.
• Frozen-install integrity gate: npm ci exits 0 on the committed lockfile (npm 10 / Node 18, matching CI).
• Deprecation gate: no touched version is deprecated (4.18.0 explicitly avoided).
• Release-age gate: both targets published well over 7 days ago.
• Wiz re-scan: PASSED_BY_POLICY, 0 library findings.

Toolchain: Node 18.20.8 / npm 10.9.8. Test command (from CI integration.yml):
npm run build && npm run test-lint && npm run test-system && npm run test-unit.

[github-actions]

unit test code coverage

Lines	Statements	Branches	Functions
	89.04% (5926/6655)	80.9% (3893/4812)	94.05% (870/925)

Coverage Breakdown • (89%)

File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
All files	89.04	80.9	94.05	89.16

report-only-changed-files is enabled. No files were changed in this commit :)

[github-actions]

integration test code coverage

Lines	Statements	Branches	Functions
	19.68% (2118/10759)	13.36% (1002/7496)	20.66% (248/1200)

Coverage Breakdown • (19%)

File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
All files	19.68	13.36	20.66	19.98

report-only-changed-files is enabled. No files were changed in this commit :)