[SECURITY] Update koa, @hapi/wreck and related HTTP framework deps in neo4j and appsync examples #335

Overview

Several HTTP framework packages (koa, @hapi/wreck, @hapi/hapi, @hapi/h2o2, @hapi/content) used by the neo4j and AppSync examples have known security vulnerabilities that require major version bumps. This issue tracks the investigation into a safe upgrade path.

Open Dependabot alerts: 9 koa + 6 @hapi/wreck + related = ~20 total

Vulnerabilities

koa

Fixed in: koa >= 2.16.1

@hapi/wreck

Affected Examples

Investigation Scope

koa (fix: >= 2.16.1)

koa is used by the local simulator plugins. Check if the simulator supports the newer koa API:

cd examples/serverless-appsync-node-typescript
npm ls koa
# Check if koa is a direct dep of the simulator or the example

Then try adding an override:

"overrides": { "koa": "^2.16.1" }

And verify the simulator still starts.

@hapi/wreck and @hapi/* packages (neo4j example)

The serverless-neo4j-ec2 example uses hapi for its HTTP interface. The entire hapi ecosystem uses peer dependency constraints between packages — upgrading one often requires upgrading all.

Steps to investigate:

1. Check what top-level code uses hapi:

   grep -r "require.*hapi\|from.*hapi" examples/serverless-neo4j-ec2/src/

2. Map the current hapi versions to the hapi compatibility table
3. Determine the minimum upgrade path that resolves all advisories

Proposed Fix

For koa (simpler): Add overrides in the affected package.json files:

"overrides": {
 "koa": "^2.16.4"
}

For @Hapi (complex): Update @hapi/hapi to the latest v21.x and align all sibling packages:

npm install @hapi/hapi@^21 @hapi/wreck@^18 @hapi/h2o2@^10 @hapi/content@^6 --save

Then verify the neo4j example's Lambda handler still compiles and the integration logic still works.

Validation

# koa fix validation:
cd examples/serverless-s3-local
npm ls koa # should show >= 2.16.1
npm audit | grep koa # should return 0
# hapi fix validation:
cd examples/serverless-neo4j-ec2
npm ls @hapi/wreck # should show >= 18.x
npm audit | grep hapi # should return 0

References

• GHSA-9hgf-ppgf-gqp5 — koa HTTP request smuggling
• koa changelog
• GHSA-c429-5p7v-vgjp — @hapi/wreck SSRF
• hapi compatibility table
• npm overrides docs