Update NodeJS / CAP dependencies for frameworks/cap/test/**

[data-douser]

What This PR Contributes

This pull request updates the dependencies for frameworks/cap/test/** projects to use the latest major versions of @sap/cds, express, and, where applicable, @sap/cds-dk. These changes help ensure compatibility with the latest features and security updates in the CAP framework and Express.

Dependency upgrades:

• Updated @sap/cds to version ^10 (or ^10.0.3 where previously pinned) in all affected package.json files to ensure compatibility with the latest CAP features and fixes. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]
• Upgraded express to version ^5.2.1 in all affected projects, replacing various older 4.x versions to benefit from the latest Express improvements and security patches. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]
• Updated @sap/cds-dk to version ^10.0.4 in projects where it was previously specified, ensuring alignment with the main @sap/cds version. [1] [2]

These updates are important for keeping the test projects up-to-date, secure, and compatible with the latest CAP and Express releases.

Future Works

[Copilot]

Pull request overview

This PR updates the dependency versions used by CAP/Express-based test fixture projects under javascript/frameworks/cap/test/**, aligning them with newer major releases of @sap/cds, express, and (where present) @sap/cds-dk to keep the fixtures current with upstream CAP/Express changes.

Changes:

• Bumped @sap/cds dependency ranges to ^10 (or ^10.0.3 in one fixture).
• Upgraded express across the affected fixtures to ^5.2.1.
• Updated @sap/cds-dk in the fixtures that use it to ^10.0.4.

Show a summary per file

File	Description
javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/package.json	Bumps CAP + Express dependency ranges for this log-injection fixture.
javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/package.json	Bumps CAP + Express dependency ranges for this log-injection fixture.
javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/package.json	Bumps CAP + Express dependency ranges for this log-injection fixture.
javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/package.json	Bumps CAP + Express dependency ranges for this log-injection fixture.
javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/package.json	Updates CAP, cds-dk, and Express versions for the sanitized log-injection fixture.
javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/package.json	Bumps CAP + Express dependency ranges for this log-injection fixture.
javascript/frameworks/cap/test/queries/cqlinjection/package.json	Updates CAP, cds-dk, and Express versions for the CQL injection fixture.
javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json	Updates CAP + Express versions for the non-production authn strategy fixture.
javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json	Updates CAP + Express versions for the non-production authn strategy fixture.
javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json	Updates CAP + Express versions for the non-production authn strategy fixture.
javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package.json	Updates Express version (and should align CAP versioning intent with PR description).
javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/package.json	Updates CAP + Express versions for privileged-user authn fixture.
javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/package.json	Updates CAP + Express versions for “no authz” entity exposure fixture.
javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/package.json	Updates CAP + Express versions for JS authz entity exposure fixture.
javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/package.json	Updates CAP + Express versions for JS authz entity exposure fixture (cds serve variant).
javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/package.json	Updates CAP + Express versions for cds authz entity exposure fixture.
javascript/frameworks/cap/test/models/cds/remoteflowsources/package.json	Updates CAP + Express versions for the remote flow sources model fixture.
javascript/frameworks/cap/test/models/cds/entityreference/package.json	Updates CAP + Express versions for the entity reference model fixture.

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 1
• Review effort level: Low

[Copilot]

Review details

Comments suppressed due to low confidence (3)

javascript/frameworks/cap/test/models/cds/entityreference/package.json:8

• This project has a checked-in package-lock.json, but it still declares @sap/cds as "^7" and express as "^4.22.2" (and doesn’t include @sap/cds-dk). With package.json now pinned to @sap/cds 10.0.5 / express 5.2.1 / @sap/cds-dk 10.0.5, npm installs will be inconsistent and CI may fail with a lockfile mismatch. Regenerate/update the lockfile so it matches the new dependency set.

    "@sap/cds": "10.0.5",
    "@sap/cds-dk": "10.0.5",
    "express": "5.2.1",
    "@cap-js/sqlite": "*"

javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package.json:8

• This project has a checked-in package-lock.json, but it still declares @sap/cds as "*" and express as "^4.22.2" (and doesn’t include @sap/cds-dk). With package.json now pinned to @sap/cds 10.0.5 / express 5.2.1 / @sap/cds-dk 10.0.5, npm installs will be inconsistent and CI may fail with a lockfile mismatch. Regenerate/update the lockfile so it matches the new dependency set.

    "@sap/cds": "10.0.5",
    "@sap/cds-dk": "10.0.5",
    "express": "5.2.1",
    "@cap-js/sqlite": "*"

javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/package.json:7

• The PR description says these test projects were updated to use caret ranges (e.g. @sap/cds "^10" / express "^5.2.1") and mentions @sap/cds-dk "^10.0.4", but this package.json pins exact versions (10.0.5 / 5.2.1) and uses @sap/cds-dk 10.0.5. Please align either the dependency specifiers here (and in the other updated package.json files) or update the PR description so it accurately reflects what was changed.

    "@sap/cds": "10.0.5",
    "@sap/cds-dk": "10.0.5",
    "express": "5.2.1"

• Files reviewed: 18/18 changed files
• Comments generated: 0 new
• Review effort level: Low