[deniswsrosa]

Summary

• Updates direct npm dependency express from ^4.22.2 to ^5.2.1 and regenerates package-lock.json with the existing npm lockfile v2 format.
• Applies the minimal Express 5 compatibility fix for the catch-all 404 handler (app.get('*', ...) -> app.use(...)).
• Leaves Babel packages on 7.29.7 because Babel 8 requires Node ^22.18.0 || >=24.11.0, while this repository's CI and Dockerfile target Node 20.

Updated dependencies

Ecosystem	Dependency	Previous	Updated	Type	Notes
npm	express	^4.22.2	^5.2.1	direct production dependency	Requires minimal catch-all route compatibility fix under Express 5/path-to-regexp.

Validation

Commands run locally:

npm install --lockfile-version=2
npm outdated --json --depth=0
npm ls --depth=0
npm run build
DB_CONN_STR=couchbase://127.0.0.1 DB_USERNAME=Administrator DB_PASSWORD=password DB_BUCKET_NAME=travel-sample APP_PORT=3000 npm run testGA
npm test
# Node 20 CI compatibility check in dockerized copy:
docker run --rm -v /home/ubuntu/.hermes/kanban/workspaces/t_c9eb6d34/node20-copy:/app -w /app node:20 npm ci
docker run --rm -v /home/ubuntu/.hermes/kanban/workspaces/t_c9eb6d34/node20-copy:/app -w /app node:20 npm run build
npm start
curl -i -L http://127.0.0.1:3000/
curl -i http://127.0.0.1:3000/swagger-ui/

Gate	Result	Evidence
Install / lockfile regeneration	Passed	npm install --lockfile-version=2; lockfile remains version 2.
Direct dependency inventory	Passed	npm ls --depth=0 shows express@5.2.1; Babel packages remain 7.29.7 due Node 20 constraint.
Build	Passed	npm run build compiled 10 files with Babel.
Integration tests	Passed	npm run testGA: 19/19 test suites passed against local Couchbase travel-sample.
Config-file test path	Passed	npm test: 19/19 test suites passed via config/test.env.
Node 20 CI compatibility	Passed	Docker node:20 ran npm ci and npm run build successfully.
Browser / Swagger evidence	Passed	Local app served /swagger-ui/ with Swagger UI title and OpenAPI endpoint listing.

Risk notes

• Existing Dependabot PRs are open for Express/transitive dependency updates. This PR is the locally validated Express 5 update from the dependency-update preflight and includes the required Express 5 route compatibility fix.
• Babel 8 was intentionally not included because it is incompatible with the repository's Node 20 CI/runtime target.
• No generated dist, node_modules, environment files, Couchbase logs, or evidence artifacts are committed.

Rollback

Revert this PR to restore express to ^4.22.2, the previous lockfile graph, and the prior catch-all route declaration.

[gemini-code-assist]

Code Review

This pull request upgrades the express dependency from version 4.x to 5.x, updating its corresponding sub-dependencies in package-lock.json. Additionally, in src/app.js, the wildcard route handler has been changed from app.get('*', ...) to a catch-all middleware app.use(...) to handle 404 errors for all HTTP methods instead of just GET requests. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[ejscribner]

@dex-the-ai is this superseded by another pr?

[dex-the-ai]

@ejscribner Yes, #257 supersedes this one. #257 is "chore(deps): consolidate dependency updates (express 5, jest, prettier, supertest, transitive)" and it was merged into master today at 2026-09-29 21:35 UTC as 97f19cb.

This PR has nothing left that master doesn't already have:

• Express: master's package.json already has "express": "^5.2.1", the same bump this PR makes. chore(deps): consolidate dependency updates (express 5, jest, prettier, supertest, transitive) #257's dependency table lists this PR as overlapping.
• Catch-all 404 route: master already has an Express 5-compatible catch-all in src/app.js (app.get('/{*splat}', ...)). It does the same job as this PR's app.get('*') → app.use(...) change.
• Babel/Node: this PR kept Babel on 7.x because the runtime was Node 20. chore(deps): consolidate dependency updates (express 5, jest, prettier, supertest, transitive) #257 moved the Dockerfile and CI to Node 24 and upgraded Babel, so that limitation no longer applies.

If you rebased this branch now, you'd get lockfile conflicts and no functional change. I'd suggest closing it as superseded by #257. I've left it open because it's @deniswsrosa's PR.