From 1813043fc3d1bcf7bdafc11d7deda592bb49256e Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Thu, 29 Oct 2026 17:07:18 +0100
Subject: [PATCH 1/3] fix(security): pin Node runtime floor to 22.23.4 for
 CVE-2026-111497

Brotli C decoder out-of-bounds write (CWE-787/CWE-252). Node 22.x is
vulnerable below 22.23.4. Raise engines.node floor so the CF
nodejs_buildpack installs a patched 22.x at staging; cap <23 to stay on
the buildpack-supported 22 line.

Reachable only via undici auto-decompression of Content-Encoding: br
from outbound fetches (all trusted SAP/GitHub hosts over TLS), so this
is a defense-in-depth runtime bump, not an active-exploit hotfix.
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 337cc9427..9da1b85d3 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "engines": {
-    "node": ">=22.12"
+    "node": ">=22.23.4 <23"
   },
   "scripts": {
     "start": "cds-serve",

From 65a720be0cb625e7c0254e7c4abbc43a7bdafbef Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Thu, 29 Oct 2026 17:12:26 +0100
Subject: [PATCH 2/3] fix(security): sync srv-qa engines.node floor to 22.23.4
 (CVE-2026-111497)

srv-qa deploys as a separate CAP module from its own package.json +
lockfile; dep-parity guard requires engines.node to match root.
---
 srv-qa/package-lock.json | 2 +-
 srv-qa/package.json      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/srv-qa/package-lock.json b/srv-qa/package-lock.json
index a522e292b..0fad35a68 100644
--- a/srv-qa/package-lock.json
+++ b/srv-qa/package-lock.json
@@ -21,7 +21,7 @@
         "undici": "8.9.0"
       },
       "engines": {
-        "node": ">=22.12"
+        "node": ">=22.23.4 <23"
       }
     },
     "node_modules/@babel/code-frame": {
diff --git a/srv-qa/package.json b/srv-qa/package.json
index c24c7f235..6a37e36f7 100644
--- a/srv-qa/package.json
+++ b/srv-qa/package.json
@@ -4,7 +4,7 @@
   "main": "server.js",
   "type": "module",
   "engines": {
-    "node": ">=22.12"
+    "node": ">=22.23.4 <23"
   },
   "scripts": {
     "start": "cds-serve"

From 995119a9114dc2e9b18bd8e35d099b741d64887e Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Thu, 29 Oct 2026 17:16:13 +0100
Subject: [PATCH 3/3] fix(security): pin srv-mcp engines.node floor to 22.23.4
 (CVE-2026-111497)

The separate tutorials-mcp MTA stages tutorials-srv-mcp from gen/srv-mcp,
whose package.json is copied from committed srv-mcp/. Raise its Node floor
to match so a patched 22.x is installed at staging. No tracked lockfile;
not an npm workspace member, so package.json alone is authoritative.
---
 srv-mcp/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/srv-mcp/package.json b/srv-mcp/package.json
index dcde98244..6a095a297 100644
--- a/srv-mcp/package.json
+++ b/srv-mcp/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "main": "server.js",
   "engines": {
-    "node": ">=22.12"
+    "node": ">=22.23.4 <23"
   },
   "scripts": {
     "start": "cds-serve"