Bump codeql/javascript-all and fix breaking changes

[jeongsoolee09]

The old dataflow API was deprecated in 2.3.0. This deprecates the older APIs but immediately makes some APIs such as BarrierGuardNode.blocks invalid as they are renamed without the deprecated qualifier.

Future works

Overhaul the query to use the new APIs before the grace period ends.

[lcartey]

@jeongsoolee09 we should also update https://github.com/advanced-security/codeql-sap-js/blob/main/qlt.conf.json.

[data-douser]

Here is the git diff comparing this PR to #171 :

diff --git a/.github/workflows/run-codeql-unit-tests-javascript.yml b/.github/workflows/run-codeql-unit-tests-javascript.yml
index 8a10d70..3a3ec23 100644
--- a/.github/workflows/run-codeql-unit-tests-javascript.yml
+++ b/.github/workflows/run-codeql-unit-tests-javascript.yml
@@ -81,7 +81,8 @@ jobs:
         run: |
           if ! command -v cds &> /dev/null
           then
-            npm install -g @sap/cds-dk
+            ## Workaround for https://github.tools.sap/cap/issues/issues/17840
+            npm install -g @sap/[email protected]
           fi
 
       # Compile .cds files to .cds.json files.
@@ -97,8 +98,8 @@ jobs:
               echo "I am compiling $cds_file"
               cds compile $cds_file \
                 -2 json \
-                -o "$cds_file.json" \
-                --locations
+                --locations \
+                > "$cds_file.json" 2> "$cds_file.err"
             done
             popd
           done
diff --git a/extractors/cds/tools/index-files.sh b/extractors/cds/tools/index-files.sh
index 092d126..7e8dde8 100755
--- a/extractors/cds/tools/index-files.sh
+++ b/extractors/cds/tools/index-files.sh
@@ -36,12 +36,12 @@ then
     # directory.
     #
     # We also ensure we skip node_modules, as we can end up in a recursive loop
-    find . -type d -name node_modules -prune -false -o -type f \( -iname 'package.json' \) -exec grep -ql '@sap/cds' {} \; -execdir bash -c "grep -q \"^\$(pwd)\(/\|$\)\" \"$response_file\"" \; -execdir bash -c "echo \"Installing @sap/cds-dk into \$(pwd) to enable CDS compilation.\"" \; -execdir npm install --silent @sap/cds-dk \; -execdir npm install --silent \;
+    find . -type d -name node_modules -prune -false -o -type f \( -iname 'package.json' \) -exec grep -ql '@sap/cds' {} \; -execdir bash -c "grep -q \"^\$(pwd)\(/\|$\)\" \"$response_file\"" \; -execdir bash -c "echo \"Installing @sap/cds-dk into \$(pwd) to enable CDS compilation.\"" \; -execdir npm install --silent @sap/[email protected] \; -execdir npm install --silent \;
 
     # Use the npx command to dynamically install the cds development kit (@sap/cds-dk) package if necessary,
     # which then provides the cds command line tool in directories which are not covered by the package.json
     # install command approach above
-    cds_command="npx -y --package @sap/cds-dk cds"
+    cds_command="npx -y --package @sap/[email protected] cds"
 else
     cds_command="cds"
 fi
@@ -51,8 +51,11 @@ echo "Processing CDS files to JSON"
 # Run the cds compile command on each file in the response file, outputting the compiled JSON to a file with
 # the same name
 while IFS= read -r cds_file; do
-    echo "Processing CDS file $cds_file to:"
-    if ! $cds_command compile "$cds_file" -2 json -o "$cds_file.json" --locations 2> "$cds_file.err"; then
+    echo "Processing CDS file $cds_file to: $cds_file.json"
+    # Avoid using the `-o` (or `--dest`) option as it sends output to a new directory, where we want to
+    # output to a file in the same directory as the input file but with a .json extension.
+    if ! $cds_command compile "$cds_file" -2 json --locations > "$cds_file.json" 2> "$cds_file.err"
+    then
         stderr_truncated=`grep "^\[ERROR\]" "$cds_file.err" | tail -n 4`
         error_message=$'Could not compile the file '"$cds_file"$'.\nReported error(s):\n```\n'"$stderr_truncated"$'\n```'
         echo "$error_message"
@@ -101,4 +104,4 @@ unset LGTM_INDEX_INCLUDE
 echo "Extracting the cds.json files"

[jeongsoolee09]

Thanks @data-douser for your contribution!

[data-douser]

These changes LGTM and should unblock a couple of major efforts.
Nice work @jeongsoolee09 !