From 753dcf1dfd0513eadc5a12ec4c397749b3d5e2fc Mon Sep 17 00:00:00 2001
From: d3xter666 <yavor.ivanov@sap.com>
Date: Fri, 4 Sep 2026 11:00:09 +0300
Subject: [PATCH 1/2] [INTERNAL] Bump qs to 6.16.0

Bump qs to a non vulenrable version and enforce overrides for it.

Resolves GHSA-x5fp-wj9c-mxmx & GHSA-4mjr-xmp4-gh2g
---
 package-lock.json | 17 -----------------
 package.json      | 12 +++++++++++-
 2 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 51c26a36..a6b67a32 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6986,23 +6986,6 @@
 			"inBundle": true,
 			"license": "MIT"
 		},
-		"node_modules/express/node_modules/qs": {
-			"version": "6.15.3",
-			"resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-			"integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
-			"inBundle": true,
-			"license": "BSD-3-Clause",
-			"dependencies": {
-				"es-define-property": "^1.0.1",
-				"side-channel": "^1.1.1"
-			},
-			"engines": {
-				"node": ">=0.6"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/express/node_modules/raw-body": {
 			"version": "2.5.3",
 			"resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
diff --git a/package.json b/package.json
index 832fa88f..1d459a9a 100644
--- a/package.json
+++ b/package.json
@@ -129,6 +129,16 @@
 		"type": "git",
 		"url": "git@github.com:SAP/ui5-cli.git"
 	},
+	"overrides": {
+		"@ui5/server": {
+			"qs": "^6.16.0",
+			"express": {
+				"body-parser@1.20.6": {
+					"qs": "^6.16.0"
+				}
+			}
+		}
+	},
 	"dependencies": {
 		"@ui5/builder": "^4.3.1",
 		"@ui5/fs": "^4.0.6",
@@ -170,4 +180,4 @@
 		"strip-ansi": "^7.2.0",
 		"testdouble": "^3.20.2"
 	}
-}
+}
\ No newline at end of file

From ec00466dda12fad99f525ee52ab6f72af54acfb1 Mon Sep 17 00:00:00 2001
From: d3xter666 <yavor.ivanov@sap.com>
Date: Fri, 4 Sep 2026 12:18:38 +0300
Subject: [PATCH 2/2] refactor: Overrides block to scope around versioned
 `express`

---
 package.json | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/package.json b/package.json
index 1d459a9a..dfb2a57a 100644
--- a/package.json
+++ b/package.json
@@ -130,13 +130,11 @@
 		"url": "git@github.com:SAP/ui5-cli.git"
 	},
 	"overrides": {
-		"@ui5/server": {
-			"qs": "^6.16.0",
-			"express": {
-				"body-parser@1.20.6": {
-					"qs": "^6.16.0"
-				}
-			}
+		"express@4": {
+			"body-parser@1.20.6": {
+				"qs": "^6.16.0"
+			},
+			"qs": "^6.16.0"
 		}
 	},
 	"dependencies": {