[Snyk] Fix for 1 vulnerabilities

[caniszczyk]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncaught Exception SNYK-JS-QS-19432019	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncaught Exception

[caniszczyk]

This update includes major version upgrades for both express and body-parser, introducing significant breaking changes that require code and environment modifications.

Express 4.18.2 → 5.1.0 (High Risk)

This is a long-awaited major release with several fundamental changes. An official migration tool is available to automate many of the required code changes.

Key Breaking Changes:

• Node.js Requirement: Express 5 requires Node.js version 18 or higher.
• Asynchronous Error Handling: Rejected promises in async route handlers are now automatically caught and passed to the error-handling middleware. This may simplify code by removing the need for try/catch blocks but could conflict with existing error handling logic.
• Routing and Path Matching: The path-matching syntax is stricter. Inline regular expressions like app.get('/:id(\d+)') are no longer supported and must be refactored.
• Removed Methods: Several deprecated methods have been removed, including app.del() (use app.delete()) and req.param(name) (use req.params, req.body, or req.query directly).

body-parser 1.20.1 → 2.1.0 (High Risk)

This upgrade aligns with the changes in Express 5 and introduces its own breaking changes.

Key Breaking Changes:

• Node.js Requirement: Version 2.0.0 and later require Node.js 18 or higher.
• req.body Behavior: req.body is no longer initialized to an empty object ({}) if no body is parsed. It will be undefined, which can break code that assumes req.body always exists.
• Middleware Removal: The combined bodyParser() middleware has been removed. You must use the specific parsers individually (e.g., bodyParser.json(), bodyParser.urlencoded()).

Recommendation:

1. Upgrade Node.js: Ensure your deployment environment and CI/CD pipelines are running on Node.js 18 or a newer version.
2. Run Codemods: Start by running the official Express codemods to automatically fix many of the breaking API changes: npx @expressjs/codemod upgrade.
3. Review Code: Manually review changes related to routing patterns, async error handling, and any code that assumes req.body is always an object.
4. Test Thoroughly: These changes affect the core request/response cycle and require extensive testing before deployment.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[mergeable]

Thanks for creating a pull request! A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.