From c3c4d542df3107c4e96657c96a16de8650c4ade3 Mon Sep 17 00:00:00 2001 From: Thomas Jung <12159356+jung-thomas@users.noreply.github.com> Date: Fri, 26 Jun 2026 12:17:59 -0400 Subject: [PATCH] chore(deps): patch ws and form-data advisories in approuter Resolves two open Dependabot alerts: - #193 form-data <4.0.6 CRLF injection (high) -> form-data 4.0.6 - #194 ws <7.5.11 memory-exhaustion DoS (high) -> ws 7.5.11 How: - Lockfile in app/router/ was stale at @sap/approuter 21.5.0 even though PR #37 had already bumped the manifest to ^22.0.1. Regenerated it; npm resolves to @sap/approuter 22.0.3 (latest), which pulls axios 1.16.1 -> form-data 4.0.6. Closes #193. - @sap/approuter 22.0.3 still pins ws: '7.5.10' exactly, so a lockfile-only fix can't reach 7.5.11. Added an npm 'overrides' entry to force ws ^7.5.11. Closes #194. The override is a workaround until SAP bumps the ws pin in a future @sap/approuter release. ws 7.5.11 is a patch over 7.5.10 (same minor line), so the risk of regression is low; the approuter module still loads cleanly with the override applied. Verified: npm audit in app/router/ reports 0 vulnerabilities; node -e "require('@sap/approuter')" loads without errors. --- .../MyHANAApp/app/router/package-lock.json | 47 ++++++++++--------- solution/MyHANAApp/app/router/package.json | 3 ++ 2 files changed, 27 insertions(+), 23 deletions(-) diff --git a/solution/MyHANAApp/app/router/package-lock.json b/solution/MyHANAApp/app/router/package-lock.json index cbc4c6c..02a48d5 100644 --- a/solution/MyHANAApp/app/router/package-lock.json +++ b/solution/MyHANAApp/app/router/package-lock.json @@ -28,14 +28,14 @@ "license": "MIT" }, "node_modules/@sap/approuter": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@sap/approuter/-/approuter-22.0.1.tgz", - "integrity": "sha512-cjbhJFBt4HwVyWwJygPi3yDHZde3/msZ45CG297utzYpNxTxIr0xBylQyl+FuTxtvS0O5efrlPqxzyr5kd6bZg==", + "version": "22.0.3", + "resolved": "https://registry.npmjs.org/@sap/approuter/-/approuter-22.0.3.tgz", + "integrity": "sha512-hjtf23npfT+9qNVZ6URHnhWT2sER8YZfjaxQKSwRl+P7Npu/ySSNSQWnqZvdtiH8PsrB5eBd7tTSNmfxy/n/vA==", "license": "SEE LICENSE IN LICENSE", "dependencies": { "@sap/audit-logging": "7.0.0", "@sap/e2e-trace": "6.0.0", - "@sap/logging": "9.2.0", + "@sap/logging": "9.2.1", "@sap/xsenv": "6.0.0", "@sap/xssec": "4.12.2", "agentkeepalive": "4.6.0", @@ -148,13 +148,13 @@ } }, "node_modules/@sap/logging": { - "version": "9.2.0", - "resolved": "https://registry.npmjs.org/@sap/logging/-/logging-9.2.0.tgz", - "integrity": "sha512-qy9ADRZdJGMx5HwVvJQAwAWd2JWzO3aTxOaqkodfZB6xa4taMaPJXKgp5l50kguoj/FSh85LxlhS7msJkBoY5Q==", + "version": "9.2.1", + "resolved": "https://registry.npmjs.org/@sap/logging/-/logging-9.2.1.tgz", + "integrity": "sha512-ffeyy3T57fMgMGsmvj58K+bXS7b8f3AReICDOGMPwKOUVRtwG0Qm2gCkoMyq+VU0ioQrXKdlLuSy/ZwlIrTjLg==", "license": "SEE LICENSE IN LICENSE file", "dependencies": { "@sap/e2e-trace": "^6.2.1", - "lodash": "4.18.01", + "lodash": "4.18.1", "moment": "2.30.1" }, "engines": { @@ -974,16 +974,16 @@ } }, "node_modules/form-data": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz", - "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==", + "version": "4.0.6", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz", + "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==", "license": "MIT", "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", - "hasown": "^2.0.2", - "mime-types": "^2.1.12" + "hasown": "^2.0.4", + "mime-types": "^2.1.35" }, "engines": { "node": ">= 6" @@ -1640,12 +1640,13 @@ } }, "node_modules/qs": { - "version": "6.15.2", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", - "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", + "version": "6.15.3", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", + "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", "license": "BSD-3-Clause", "dependencies": { - "side-channel": "^1.1.0" + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" }, "engines": { "node": ">=0.6" @@ -1825,9 +1826,9 @@ "license": "MIT" }, "node_modules/semver": { - "version": "7.8.4", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.4.tgz", - "integrity": "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==", + "version": "7.8.5", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", + "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", "license": "ISC", "bin": { "semver": "bin/semver.js" @@ -2261,9 +2262,9 @@ "license": "ISC" }, "node_modules/ws": { - "version": "7.5.10", - "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.10.tgz", - "integrity": "sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==", + "version": "7.5.11", + "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.11.tgz", + "integrity": "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==", "license": "MIT", "engines": { "node": ">=8.3.0" diff --git a/solution/MyHANAApp/app/router/package.json b/solution/MyHANAApp/app/router/package.json index 10a876c..f469c27 100644 --- a/solution/MyHANAApp/app/router/package.json +++ b/solution/MyHANAApp/app/router/package.json @@ -3,6 +3,9 @@ "dependencies": { "@sap/approuter": "^22.0.1" }, + "overrides": { + "ws": "^7.5.11" + }, "engines": { "node": "^24" },