v2.2.2

A patch for v2.2.1 that fixes a start-up failure on fresh installs and several security vulnerabilities. There are no database migrations and no new features. Upgrading promptly is recommended.

**Fresh installs of v2.2.1 fail to start.** The upload storage imported `concat-stream`, which was never declared and only arrived through `multer` 2.3.0 or older. `multer` 2.4.0 dropped it, and the `^2.2.0` range now resolves to 2.4.0, so the admin GraphQL schema fails to load at bootstrap. Stores that already have a lockfile with the older `multer` were not affected. On v2.2.1, `npm install concat-stream` is a workaround.

## Security

* **Order data exposure through the public GraphQL API** (CVE-2025-12919, CWE-639, #881): `Query.order(uuid)` returned name, email, phone, addresses, items and shipment tracking to anyone who knew an order UUID.
* **Authorization bypass** (CWE-306 / CWE-863): an API route middleware that declared its own `after` list (for example `[bodyParser]saveGroup.js`) could run before authentication.
* **SQL injection** (CWE-89) through the query builder's raw-SQL escape hatch: a request body passed as a `.where()` value could set `{ isSQL: true }` to inline unbound SQL. Fixed in `@evershop/postgres-query-builder` 2.1.1.
* **Server-side code evaluation** (CWE-95): the GraphQL query builder evaluated the decoded arguments of `getContextValue(...)` tokens as JavaScript.
* **Dependencies**: 53 of the 55 open high and critical alerts, including a `multer` denial of service and `sharp` / libvips / libheif fixes.

## Bug Fixes

* Fixed the fresh-install start-up failure described above. The upload storage now joins the chunks with `Buffer.concat`, as `multer`'s own memory storage does, and still enforces the per-type size limit while the file streams.

## Dependencies

* Upgraded: `multer` ^2.4.0, `sharp` 0.33 → 0.35 (**requires Node.js 20.9 or newer**), `axios` ^1.20.0, `undici` ^7.30.0, `@evershop/postgres-query-builder` ^2.1.1.
* Removed: `cypress` (dev; the end-to-end tests use Playwright).

## Upgrade Notes

1. Update `@evershop/evershop`, reinstall dependencies and run `npm run build`. Use Node.js 20.9 or newer.
2. **Raw SQL in the query builder needs `sql()`.** A hand-written `{ isSQL: true, value: '...' }` object is now treated as an ordinary bound value. Replace such objects in extensions with `sql('...')`.
3. **`getContextValue(...)` in a route's GraphQL `query` or `variables` takes data literals only** (strings, numbers, booleans, `null`, arrays and objects). An expression now throws instead of running.
4. **`Query.order(uuid)` returns `null` unless access is proven.** An order is returned only to an admin, to the customer who owns it, or to a page that called `grantOrderAccess(request, uuid, via)` (exported from `@evershop/evershop/oms/services`). Core's checkout success page and the order tracking page already do. A custom page, theme or extension that reads `order(uuid)` on its own must call it after checking access.
5. **Authentication is now enforced on API route middleware that declares its own `after` list.** If a route middleware is ordered ahead of a pre-auth one, you now get an explicit error message instead of an opaque cycle error.