[SECURITY] Update koa, @hapi/wreck and related HTTP framework deps in neo4j and appsync examples

[ulises-jeremias]

Overview

Several HTTP framework packages (koa, @hapi/wreck, @hapi/hapi, @hapi/h2o2, @hapi/content) used by the neo4j and AppSync examples have known security vulnerabilities that require major version bumps. This issue tracks the investigation into a safe upgrade path.

Open Dependabot alerts: 9 koa + 6 @hapi/wreck + related = ~20 total

---

Vulnerabilities

koa

Advisory	Severity	Description
GHSA-9hgf-ppgf-gqp5	High	HTTP request smuggling via Transfer-Encoding header
GHSA-vc6j-gq6m-7wj3	Medium	DoS via malformed Content-Type header

Fixed in: koa >= 2.16.1

@hapi/wreck

Advisory	Severity	Description
GHSA-c429-5p7v-vgjp	High	Server-Side Request Forgery (SSRF)
GHSA-qm7x-rc44-rrqw	High	HTTP response splitting

---

Affected Examples

Example	Package	Current use
examples/serverless-appsync-node-typescript	koa	AppSync local simulator
examples/serverless-appsync-python	koa	AppSync local simulator
examples/serverless-s3-local	koa	S3 local simulator
examples/serverless-neo4j-ec2	@hapi/hapi, @hapi/wreck, @hapi/h2o2, @hapi/content	Neo4j HTTP server

---

Investigation Scope

koa (fix: >= 2.16.1)

koa is used by the local simulator plugins. Check if the simulator supports the newer koa API:

cd examples/serverless-appsync-node-typescript
npm ls koa
# Check if koa is a direct dep of the simulator or the example

Then try adding an override:

"overrides": { "koa": "^2.16.1" }

And verify the simulator still starts.

@hapi/wreck and @hapi/* packages (neo4j example)

The serverless-neo4j-ec2 example uses hapi for its HTTP interface. The entire hapi ecosystem uses peer dependency constraints between packages — upgrading one often requires upgrading all.

Steps to investigate:

1. Check what top-level code uses hapi:

   grep -r "require.*hapi\|from.*hapi" examples/serverless-neo4j-ec2/src/

2. Map the current hapi versions to the hapi compatibility table
3. Determine the minimum upgrade path that resolves all advisories

---

Proposed Fix

For koa (simpler): Add overrides in the affected package.json files:

"overrides": {
  "koa": "^2.16.4"
}

For @Hapi (complex): Update @hapi/hapi to the latest v21.x and align all sibling packages:

npm install @hapi/hapi@^21 @hapi/wreck@^18 @hapi/h2o2@^10 @hapi/content@^6 --save

Then verify the neo4j example's Lambda handler still compiles and the integration logic still works.

---

Validation

# koa fix validation:
cd examples/serverless-s3-local
npm ls koa           # should show >= 2.16.1
npm audit | grep koa # should return 0

# hapi fix validation:
cd examples/serverless-neo4j-ec2
npm ls @hapi/wreck    # should show >= 18.x
npm audit | grep hapi # should return 0

---

References

• GHSA-9hgf-ppgf-gqp5 — koa HTTP request smuggling
• koa changelog
• GHSA-c429-5p7v-vgjp — @hapi/wreck SSRF
• hapi compatibility table
• npm overrides docs