refactor: Upgrade express from 4.21.2 to 5.1.0

[parseplatformorg]

trafficstars

Snyk has created this PR to upgrade express from 4.21.2 to 5.1.0.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

• The recommended version is 14 versions ahead of your current version.

• The recommended version was released 2 months ago.

Release notes

Package name: express

• 5.1.0 - 2025-03-31

  What's Changed

  • Update captains by @ UlisesGascon in #6027
  • build: Node.js 23.0 by @ bjohansebas in #6075
  • Add funding field (v5) by @ bjohansebas in #6064
  • ✅ add discarded middleware test by @ ctcpip in #5819
  • update homepage link http to https by @ bjohansebas in #5920
  • Improve readme by @ bjohansebas in #5994
  • Add bjohansebas as repo captain for expressjs.com by @ crandmck in #6058
  • Remove Object.setPrototypeOf polyfill by @ Phillip9587 in #6081
  • fix(buffer): use node:buffer instead of safe-buffer by @ bhavya3024 in #6071
  • docs: Add DCO by @ UlisesGascon in #6048
  • cleanup: remove promise support check from tests by @ Phillip9587 in #6148
  • Use loop for acceptParams by @ blakeembrey in #6066
  • Improve documentation step in release process by @ bjohansebas in #6150
  • cleanup: remove unnecessary require for global Buffer by @ Phillip9587 in #6146
  • cleanup: remove AsyncLocalStorage check by @ Phillip9587 in #6147
  • update history.md for acceptParams change by @ jonchurch in #6177
  • docs: add @ rxmarbles to the triage team by @ UlisesGascon in #6151
  • refactor: improve readability by @ sazk07 in #6173
  • docs: clarify the security process in the triage role by @ bjohansebas in #6217
  • chore: replace methods dependency with standard library by @ jonkoops in #6196
  • Remove utils-merge dependency - use spread syntax instead by @ Phillip9587 in #6091
  • fix(securite): fix vulnerabilities by @ Abdel-Monaam-Aouini in #6211
  • refactor: prefix built-in node module imports by @ slagiewka in #6236
  • fix: remove download size badges by @ wesleytodd in #6266
  • Remove unused depd dependency by @ jonkoops in #6197
  • fix: usage of Invalid action input 'persist-credentials' for actions/setup-node@v4 in ci.yml by @ hamirmahal in #6256
  • Add support for OSSF scorecard reporting by @ UlisesGascon in #5431
  • docs: add @ Phillip9587 to the triage team by @ bjohansebas in #6276
  • fix: added a missing semicolon in css styles in examples/auth by @ pr4j3sh in #6297
  • docs: include team email in the security policy by @ UlisesGascon in #6278
  • refactor: simplify normalizeTypes function by @ Ayoub-Mabrouk in #6097
  • ci: updated github actions ci workflow by @ Phillip9587 in #6314
  • ci: fix npm install --include typo by @ Phillip9587 in #6324
  • ci: updated scorecard actions by @ Phillip9587 in #6322
  • build(deps): use carat notation for dependency versions by @ dpopp07 in #6317
  • chore(deps): update debug to ^4.4.0 by @ Phillip9587 in #6313
  • docs: retroactively note 5.0.0-beta.1 api change in history file by @ dpopp07 in #6333
  • feat(deps): body-parser@^2.1.0 by @ wesleytodd in #6332
  • feat(deps): router@^2.1.0 by @ wesleytodd in #6331
  • Update repo captains by @ UlisesGascon in #6234
  • deps: upgrade nyc by @ agungjati in #6122
  • fix (deps): update deps by @ wesleytodd in #6337
  • response: add support for ETag option in res.sendFile by @ juanarbol in #6073
  • Update multiple links to use https instead of http by @ Phillip9587 in #6338
  • Extend res.links() to allow adding multiple links with the same rel #2729 by @ andvea in #4885
  • docs: update emeritus triagers by @ UlisesGascon in #6345
  • docs: update guidance for triager nominations by @ bjohansebas in #6349
  • docs: clarify guidelines for becoming a committer by @ bjohansebas in #6364
  • Nominate @ dpopp07 to the triage team by @ UlisesGascon in #6352
  • fix(deps): qs@^6.14.0 by @ wesleytodd in #6374
  • Add dependabot by @ UlisesGascon in #5435
  • fix dependabot config by @ bjohansebas in #6392
  • build(deps): bump github/codeql-action from 3.24.7 to 3.28.11 by @ dependabot in #6398
  • build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @ dependabot in #6397
  • feat(deps): [email protected] by @ wesleytodd in #6373
  • build(deps-dev): bump cookie-session from 2.0.0 to 2.1.0 by @ dependabot in #6399
  • deps: body-parser@^2.2.0 by @ UlisesGascon in #6419
  • deps: type-is@^2.0.1 by @ UlisesGascon in #6420
  • deps: router@^2.2.0 by @ UlisesGascon in #6417
  • ci: use full SHAs for github action versions by @ Phillip9587 in #6415
  • doc: remove @ mertcanaltin from Triagers by @ mertcanaltin in #6408
  • deps: serve-static@^2.2.0 by @ UlisesGascon in #6418
  • 5.1.0 by @ wesleytodd in #6425

  New Contributors

  • @ bhavya3024 made their first contribution in #6071
  • @ jonkoops made their first contribution in #6196
  • @ Abdel-Monaam-Aouini made their first contribution in #6211
  • @ slagiewka made their first contribution in #6236
  • @ hamirmahal made their first contribution in #6256
  • @ pr4j3sh made their first contribution in #6297
  • @ Ayoub-Mabrouk made their first contribution in #6097
  • @ dpopp07 made their first contribution in #6317
  • @ agungjati made their first contribution in #6122
  • @ andvea made their first contribution in #4885
  • @ dependabot made their first contribution in #6398

  Full Changelog: 5.0.1...v5.1.0

• 5.0.1 - 2024-10-08

  What's Changed

  • remove --bail from test script by @ jonchurch in #5962
  • Nominate @ bjohansebas to the triage team by @ UlisesGascon in #6009
  • Link and update captains by @ blakeembrey in #6013
  • Update cookie semver lock to address CVE-2024-47764 by @ joshbuker in #6017
  • Release: 5.0.1 by @ UlisesGascon in #6032

  Full Changelog: v5.0.0...5.0.1

• 5.0.0 - 2024-09-10

  Express v5.0.0

  🎉 Express v5 is finally here! 🎉

  After years of development, the long-awaited Express v5 has been officially released. This version focuses on simplifying the codebase, improving security, and dropping support for older Node.js versions to enable better performance and maintainability.

  For detailed information, please check out the official Express v5 release blog post.

  Most relevant details

  Major Changes in v5

  • Node.js version support: Dropped support for Node.js versions before v18.
  • Routing changes: Updated to [email protected], removing sub-expression regex patterns for security reasons (ReDoS mitigation).
  • Promise support: Middleware can now return rejected promises, caught by the router as errors.
  • body-parser changes: Several improvements including the ability to customize urlencoded body depth and defaulting extended to false.
  • Deprecated API methods removed: Removed old, deprecated API method signatures from Express v3/v4.

  For a complete list of breaking changes and API deprecations, see the migration guide.

  Security Updates

  This release includes important security fixes, including improvements to prevent ReDoS attacks and mitigation for CVE-2024-45590. Full details can be found in the security release notes.

  Migration

  Be sure to check out our migration guide for instructions on how to update your applications from Express v4 to v5.

  Security Guidance

  For best practices, we recommend reviewing the Threat Model which outlines Express' approach to securing your applications, including tips for user input validation and other critical aspects.

  What's Changed

  • 4.19.2 Staging by @ wesleytodd in #5561
  • remove duplicate location test for data uri by @ wesleytodd in #5562
  • feat: document beta releases expectations by @ marco-ippolito in #5565
  • Cut down on duplicated CI runs by @ jonchurch in #5564
  • Add a Threat Model by @ UlisesGascon in #5526
  • Assign captain of encodeurl by @ blakeembrey in #5579
  • Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @ jonchurch in #5587
  • docs: update Security.md by @ inigomarquinez in #5590
  • docs: update triage nomination policy by @ UlisesGascon in #5600
  • Add CodeQL (SAST) by @ UlisesGascon in