npm: update express to 5.1 #8529

Author: haraldschilly

src/.claude/settings.json

@@ -19,8 +19,11 @@
       "Bash(npx tsc:*)",
       "Bash(pnpm build:*)",
       "Bash(pnpm i18n:*)",
+      "Bash(pnpm list:*)",
       "Bash(pnpm ts-build:*)",
       "Bash(pnpm tsc:*)",
+      "Bash(pnpm view:*)",
+      "Bash(pnpm why:*)",
       "Bash(prettier -w:*)",
       "Bash(psql:*)",
       "WebFetch(domain:cocalc.com)",
@@ -29,11 +32,15 @@
       "WebFetch(domain:github.com)",
       "WebFetch(domain:mistral.ai)",
       "WebFetch(domain:simplelocalize.io)",
-      "Bash(pnpm list:*)",
-      "Bash(pnpm why:*)",
-      "mcp__github__get_issue",
       "WebFetch(domain:www.anthropic.com)",
-      "mcp__cclsp__find_definition"
+      "mcp__cclsp__find_definition",
+      "mcp__github__get_issue",
+      "mcp__github__get_issue_comments",
+      "mcp__github__get_pull_request",
+      "mcp__github__get_pull_request_comments",
+      "mcp__github__get_pull_request_status",
+      "mcp__github__list_workflow_runs",
+      "mcp__github__list_workflows"
     ],
     "deny": []
   }

src/packages/hub/package.json

@@ -28,7 +28,7 @@
     "cookies": "^0.8.0",
     "cors": "^2.8.5",
     "debug": "^4.4.0",
-    "express": "^4.21.2",
+    "express": "^5.1.0",
     "formidable": "^3.5.4",
     "http-proxy-3": "^1.20.8",
     "lodash": "^4.17.21",
@@ -47,7 +47,7 @@
   },
   "devDependenicesNotes": "For license and size reasons, we make @cocalc/crm a dev dependency so it is NOT installed unless explicitly installed as a separate step.",
   "devDependencies": {
-    "@types/express": "^4.17.21",
+    "@types/express": "^5.0.3",
     "@types/node": "^18.16.14",
     "coffeescript": "^2.5.1"
   },

src/packages/hub/proxy/index.ts

@@ -23,16 +23,24 @@ interface Options {
 export default function initProxy(opts: Options) {
   const proxy_regexp = `^${
     base_path.length <= 1 ? "" : base_path
-  }\/[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\/*`;
-  logger.info("creating proxy server with proxy_regexp", proxy_regexp);
+  }/[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}/`;
+  const proxy_pattern = `${
+    base_path.length <= 1 ? "" : base_path
+  }/:project_id/*splat`;
+  logger.info(
+    "creating proxy server with proxy_regexp",
+    proxy_regexp,
+    "proxy_pattern",
+    proxy_pattern,
+  );
 
   // tcp connections:
   const handleProxy = initRequest(opts);
 
   // websocket upgrades:
   const handleUpgrade = initUpgrade(opts, proxy_regexp);
 
-  opts.app.all(proxy_regexp, handleProxy);
+  opts.app.all(proxy_pattern, handleProxy);
 
   opts.httpServer.on("upgrade", handleUpgrade);
 }

src/packages/hub/servers/app/app-redirect.ts

@@ -14,7 +14,7 @@ export default function init(router: Router) {
   const winston = getLogger("app-redirect");
   const v: string[] = [];
   for (const path of APP_ROUTES) {
-    v.push(`/${path}*`);
+    v.push(`/${path}/*splat`);
   }
   router.get(v, (req, res) => {
     winston.debug(req.url);

src/packages/hub/servers/app/blobs.ts

@@ -8,7 +8,7 @@ import { getLogger } from "@cocalc/hub/logger";
 const logger = getLogger("hub:servers:app:blobs");
 export default function init(router: Router) {
   // return uuid-indexed blobs (mainly used for graphics)
-  router.get("/blobs/*", async (req, res) => {
+  router.get("/blobs/*splat", async (req, res) => {
     logger.debug(`${JSON.stringify(req.query)}, ${req.path}`);
     const uuid = `${req.query.uuid}`;
     if (req.headers["if-none-match"] === uuid) {

src/packages/hub/servers/app/next.ts

@@ -54,7 +54,7 @@ export default async function init(app: Application) {
     // 1: The raw static server:
     const raw = join(shareBasePath, "raw");
     app.all(
-      join(raw, "*"),
+      join(raw, "*splat"),
       (req: Request, res: Response, next: NextFunction) => {
         // Embedding only enabled for PDF files -- see note above
         const download =
@@ -76,7 +76,7 @@ export default async function init(app: Application) {
     // 2: The download server -- just like raw, but files always get sent via download.
     const download = join(shareBasePath, "download");
     app.all(
-      join(download, "*"),
+      join(download, "*splat"),
       (req: Request, res: Response, next: NextFunction) => {
         try {
           handleRaw({
@@ -95,21 +95,21 @@ export default async function init(app: Application) {
     // 3: Redirects for backward compat; unfortunately there's slight
     // overhead for doing this on every request.
 
-    app.all(join(shareBasePath, "*"), shareRedirect(shareBasePath));
+    app.all(join(shareBasePath, "*splat"), shareRedirect(shareBasePath));
   }
 
   const landingRedirect = createLandingRedirect();
   app.all(join(basePath, "index.html"), landingRedirect);
-  app.all(join(basePath, "doc*"), landingRedirect);
-  app.all(join(basePath, "policies*"), landingRedirect);
+  app.all(join(basePath, "doc/*splat"), landingRedirect);
+  app.all(join(basePath, "policies/*splat"), landingRedirect);
 
   // The next.js server that serves everything else.
   winston.info(
     "Now using next.js packages/share handler to handle all endpoints not otherwise handled",
   );
 
   // nextjs listens on everything else
-  app.all("*", handler);
+  app.all("*splat", handler);
 }
 
 function parseURL(req: Request, base): { id: string; path: string } {

src/packages/next/package.json

@@ -75,7 +75,7 @@
     "basic-auth": "^2.0.1",
     "csv-stringify": "^6.3.0",
     "dayjs": "^1.11.11",
-    "express": "^4.21.2",
+    "express": "^5.1.0",
     "lodash": "^4.17.21",
     "lru-cache": "^7.18.3",
     "ms": "2.1.2",
@@ -98,7 +98,7 @@
   "devDependencies": {
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.3.0",
-    "@types/express": "^4.17.21",
+    "@types/express": "^5.0.3",
     "@types/node": "^18.16.14",
     "@types/react": "^19.1.10",
     "@uiw/react-textarea-code-editor": "^3.1.1",