@sap/cds-dk 8.9.12 → 8.9.13

package/CHANGELOG.md

@@ -7,6 +7,12 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 8.9.13 - 2029-01-09
+
+### Fixed
+
+- CVE-2025-15284: update `express` to fix vulnerability with `qs` <6.14.1
+
 ## Version 8.9.12 - 2025-12-16
 
 ### Fixed

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.9.12",
+  "version": "8.9.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "8.9.12",
+      "version": "8.9.13",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -18,7 +18,7 @@
         "@sap/hdi-deploy": "^5",
         "axios": "^1",
         "eslint": "^9",
-        "express": "^4.17.3",
+        "express": "^4.22.1",
         "hdb": "^0 || ^2",
         "livereload-js": "^4.0.1",
         "mustache": "^4.0.1",
@@ -54,7 +54,7 @@
       }
     },
     "node_modules/@cap-js/openapi": {
-      "version": "1.2.3",
+      "version": "1.3.1",
       "license": "Apache-2.0",
       "dependencies": {
         "pluralize": "^8.0.0"
@@ -76,7 +76,7 @@
       }
     },
     "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.9.0",
+      "version": "4.9.1",
       "license": "MIT",
       "dependencies": {
         "eslint-visitor-keys": "^3.4.3"
@@ -230,7 +230,7 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "8.9.7",
+      "version": "8.9.8",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": "^5",
@@ -260,7 +260,7 @@
       }
     },
     "node_modules/@sap/cds-compiler": {
-      "version": "5.9.12",
+      "version": "5.9.14",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "antlr4": "4.9.3"
@@ -1017,7 +1017,7 @@
       }
     },
     "node_modules/esquery": {
-      "version": "1.6.0",
+      "version": "1.7.0",
       "license": "BSD-3-Clause",
       "dependencies": {
         "estraverse": "^5.1.0"
@@ -1413,7 +1413,7 @@
       }
     },
     "node_modules/hdb": {
-      "version": "2.26.3",
+      "version": "2.26.4",
       "license": "Apache-2.0",
       "dependencies": {
         "iconv-lite": "0.7.0"
@@ -1967,7 +1967,7 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.14.0",
+      "version": "6.14.1",
       "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.1.0"
@@ -2064,8 +2064,11 @@
       "license": "MIT"
     },
     "node_modules/sax": {
-      "version": "1.4.3",
-      "license": "BlueOak-1.0.0"
+      "version": "1.4.4",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=11.0.0"
+      }
     },
     "node_modules/semver": {
       "version": "7.7.3",
@@ -2078,7 +2081,7 @@
       }
     },
     "node_modules/send": {
-      "version": "0.19.1",
+      "version": "0.19.2",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
@@ -2087,13 +2090,13 @@
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "fresh": "0.5.2",
-        "http-errors": "2.0.0",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.1",
         "mime": "1.6.0",
         "ms": "2.1.3",
-        "on-finished": "2.4.1",
+        "on-finished": "~2.4.1",
         "range-parser": "~1.2.1",
-        "statuses": "2.0.1"
+        "statuses": "~2.0.2"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -2110,101 +2113,19 @@
       "version": "2.0.0",
       "license": "MIT"
     },
-    "node_modules/send/node_modules/http-errors": {
-      "version": "2.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "depd": "2.0.0",
-        "inherits": "2.0.4",
-        "setprototypeof": "1.2.0",
-        "statuses": "2.0.1",
-        "toidentifier": "1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/send/node_modules/statuses": {
-      "version": "2.0.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/serve-static": {
-      "version": "1.16.2",
+      "version": "1.16.3",
       "license": "MIT",
       "dependencies": {
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.19.0"
+        "send": "~0.19.1"
       },
       "engines": {
         "node": ">= 0.8.0"
       }
     },
-    "node_modules/serve-static/node_modules/debug": {
-      "version": "2.6.9",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/serve-static/node_modules/debug/node_modules/ms": {
-      "version": "2.0.0",
-      "license": "MIT"
-    },
-    "node_modules/serve-static/node_modules/http-errors": {
-      "version": "2.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "depd": "2.0.0",
-        "inherits": "2.0.4",
-        "setprototypeof": "1.2.0",
-        "statuses": "2.0.1",
-        "toidentifier": "1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/serve-static/node_modules/send": {
-      "version": "0.19.0",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "2.6.9",
-        "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "encodeurl": "~1.0.2",
-        "escape-html": "~1.0.3",
-        "etag": "~1.8.1",
-        "fresh": "0.5.2",
-        "http-errors": "2.0.0",
-        "mime": "1.6.0",
-        "ms": "2.1.3",
-        "on-finished": "2.4.1",
-        "range-parser": "~1.2.1",
-        "statuses": "2.0.1"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/serve-static/node_modules/send/node_modules/encodeurl": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/serve-static/node_modules/statuses": {
-      "version": "2.0.1",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/setprototypeof": {
       "version": "1.2.0",
       "license": "ISC"
@@ -2536,7 +2457,7 @@
       "optional": true
     },
     "node_modules/ws": {
-      "version": "8.18.3",
+      "version": "8.19.0",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.9.12",
+  "version": "8.9.13",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [
@@ -26,7 +26,7 @@
     "@sap/hdi-deploy": "^5",
     "axios": "^1",
     "eslint": "^9",
-    "express": "^4.17.3",
+    "express": "^4.22.1",
     "hdb": "^0 || ^2",
     "livereload-js": "^4.0.1",
     "mustache": "^4.0.1",