SAP / ui5-cli / 34125425996

96%

main: 96%

push

github

[FIX] Remove qs overrides from package.json

Consumers who installed @ui5/cli and ran "npm ci" got:

  npm error Missing: qs@6.15.3 from lock file

The "overrides" entry forced a single qs@6.16.0 across the bundled
express/body-parser tree at pack time. Overrides are producer-only, so
consumers re-resolve without them, expect qs@6.15.3, and the lockfile no
longer matches, breaking "npm ci".

The GHSA-x5fp-wj9c-mxmx / GHSA-4mjr-xmp4-gh2g qs vulnerability that the
override addressed is not applicable to the way express / body-parser use
qs, so removing the override does not expose us to it.

Upstream fixes are in progress but not yet consumable: the qs bumps are
still open pull requests, not merged or released, so we cannot rely on the
transitive dependencies alone yet:

  https://github.com/expressjs/express/pull/7440
  https://github.com/expressjs/body-parser/pull/761

Dropping the override lets qs resolve naturally and keeps package.json and
package-lock.json in sync.

348 of 365 branches covered (95.34%)

Branch coverage included in aggregate %.

682 of 705 relevant lines covered (96.74%)

8.38 hits per line