From 6b6e51194a0492df2a0b56c0a408aefd12a28515 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sun, 1 Nov 2026 05:09:03 -0500
Subject: [PATCH] fix(staging): pin engines.node to exact 22.23.4 for CF
 buildpack compatibility
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CF nodejs_buildpack v1.9.6 rejects compound semver ranges (>=x.y.z <n)
with "improper constraint" — it only accepts simple ranges like 22.x or
exact versions. The >=22.23.4 <23 range (set in the CVE-2026-111497 fix)
caused BuildpackCompileFailed on all three deployed modules during the
2026-11-01 DEV deploy.

Exact pin 22.23.4 satisfies the CVE floor requirement and is accepted by
the buildpack resolver. Updated: package.json, srv-qa/package.json,
srv-mcp/package.json.
---
 package.json         | 2 +-
 srv-mcp/package.json | 2 +-
 srv-qa/package.json  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 9da1b85d3..d52d7a231 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "engines": {
-    "node": ">=22.23.4 <23"
+    "node": "22.23.4"
   },
   "scripts": {
     "start": "cds-serve",
diff --git a/srv-mcp/package.json b/srv-mcp/package.json
index 6a095a297..aedc7125f 100644
--- a/srv-mcp/package.json
+++ b/srv-mcp/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "main": "server.js",
   "engines": {
-    "node": ">=22.23.4 <23"
+    "node": "22.23.4"
   },
   "scripts": {
     "start": "cds-serve"
diff --git a/srv-qa/package.json b/srv-qa/package.json
index 6a37e36f7..7a7a41d2f 100644
--- a/srv-qa/package.json
+++ b/srv-qa/package.json
@@ -4,7 +4,7 @@
   "main": "server.js",
   "type": "module",
   "engines": {
-    "node": ">=22.23.4 <23"
+    "node": "22.23.4"
   },
   "scripts": {
     "start": "cds-serve"