[Snyk] Upgrade express from 4.21.1 to 5.0.0

[nerds-github]

Snyk has created this PR to upgrade express from 4.21.1 to 5.0.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

Warning: This is a major version upgrade, and may be a breaking change.

• The recommended version is 12 versions ahead of your current version.
• The recommended version was released a month ago, on 2024-09-10.

Release notes

Package name: express

• 5.0.0 - 2024-09-10
  Read more
• 5.0.0-beta.3 - 2024-03-25
  

  Full Changelog: 5.0.0-beta.2...v5.0.0-beta.3

• 5.0.0-beta.2 - 2024-03-21
  Read more
• 5.0.0-beta.1 - 2022-02-15
• 5.0.0-alpha.8 - 2020-03-26
• 5.0.0-alpha.7 - 2018-10-27
• 5.0.0-alpha.6 - 2017-09-25
• 5.0.0-alpha.5 - 2017-03-06
• 5.0.0-alpha.4 - 2017-03-02
• 5.0.0-alpha.3 - 2017-01-29
• 5.0.0-alpha.2 - 2015-07-07
• 5.0.0-alpha.1 - 2014-11-07
• 4.21.1 - 2024-10-08
  

  What's Changed

  • Backport a fix for CVE-2024-47764 to the 4.x branch by @ joshbuker in #6029
  • Release: 4.21.1 by @ UlisesGascon in #6031

  Full Changelog: 4.21.0...4.21.1

from express GitHub release notes

Commit messages

Package name: express

• 344b022 5.0.0
• 0c49926 fix(deps): send@^1.1.0
• b3906cb fix(deps): serve-static@^2.1.0
• fed8c2a fix(deps): body-parser@^2.0.1
• bdd81f8 Delete `back` as a magic string (#5933)
• 6c98f80 🔧 update CI, remove unsupported versions, clean up
• f9256ef Merge branch '5.0' into 5-merge
• e5feb9f Merge tag '4.20.0' into 5.0
• 0264908 feat(deps)!: router@^2.0.0 (#5885)
• 4d713d2 update to fresh@2.0.0 (#5916)
• accafc6 fix(deps): finalhandler@^2.0.0 (#5899)
• 05f40f4 fix(deps)!: content-disposition@^1.0.0 (#5884)
• 402e7f6 fix(deps): type-is@^2.0.0 (#5883)
• 4e61d01 fix(deps)!: mime-types@^3.0.0 (#5882)
• 7748475 fix(deps): accepts@^2.0.0 (#5881)
• 91a58b5 cookie-signature@^1.2.1 (#5833)
• 13e6894 chore: qs@6.13.0 (#5847)
• 65b6206 fix(deps) serve-staic@2.0.0 (#5790)
• 0b243b1 5.x: Upgrading `merge-descriptors` with allowing minors (#5782)
• 0983158 refactor: replace 'path-is-absolute' dep with node:path isAbsolute method (#5830)
• 41c054c chore: upgrade `debug` dep from 3.10 to 4.3.6 (#5829)
• ecf762f fix(deps)!: send@^1.0.0 (#5786)
• 63992bb Merge branch 'ci/v5-node-lts' into 5-merge
• ea49706 Merge branch 'master' into 5-merge

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[sweep-ai]

Hey @nerds-github, here is an example of how you can ask me to improve this pull request:

@Sweep Since this is a major version upgrade of Express (4.x to 5.x), it would be advisable to add integration tests that verify the core Express functionality continues to work as expected, particularly:

1. Test route handlers still receive requests and send responses correctly
2. Test middleware chaining still functions as expected
3. Test error handling middleware still catches errors properly
4. Test that request parsing (body, query params, etc.) still works correctly

This will help catch any breaking changes introduced in Express 5.0.0 that might affect the application.

📖 For more information on how to use Sweep, please read our documentation.