chore(deps): consolidate dependency updates (express 5, jest, prettier, supertest, transitive)

[dex-the-ai]

Summary

Validated dependency consolidation for couchbase-examples/nodejs-quickstart. This PR takes the dev-tool bumps plus everything from the open Dependabot PRs, so it replaces all of them. It also moves the runtime from Node 20, which reached end-of-life on 2026-04-30, to Node 24 (Active LTS) in the Dockerfile and CI. That unblocks Babel 8. The lockfile stays at v2 and is regenerated on Node 24.21.0 / npm 11.19.0.

Updated per review feedback: bump the rest of the Dependabot PRs (Hermes task t_5e4f3c90) and update the Node runtime (Hermes task t_22c3d9b3).

Updated dependencies

Ecosystem	Dependency	Previous	Updated	Type	Supersedes
npm	express	^4.22.2 (4.22.2)	^5.2.1 (5.2.1)	dependency, major	#240, #256 (also overlaps human PR #252)
npm	jest	^30.4.2	^30.5.2	devDependency	#238
npm	prettier	^3.9.4	^3.9.9	devDependency	–
npm	supertest	^7.2.2	^7.3.0	devDependency	–
npm	qs	6.15.3	6.16.0	transitive	#256
npm	tar	7.5.19	7.5.22	transitive	#254
npm	brace-expansion	1.1.15 / 2.1.1 / 5.0.7	1.1.21 / 2.1.7 / 5.0.12	transitive	#255
npm	body-parser	1.20.5	2.3.0 (pulled in by Express 5)	transitive	#253
npm	@babel/cli, core, node, plugin-transform-runtime, preset-env	^7.29.7	^8.0.6	devDependency, major	#239
npm	@babel/runtime	^7.29.7	^8.0.5	dependency, major	–
runtime	Node.js (Dockerfile, .github/workflows/tests.yaml)	20	24	runtime, major	–

Transitive packages were refreshed with npm update inside the existing ranges. I did not use npm audit fix --force. npm audit reports 0 vulnerabilities.

Code changes for Express 5

• src/app.js: Express 5 uses path-to-regexp v8, which no longer accepts a bare * wildcard. The catch-all 404 route changes from app.get('*', …) to app.get('/{*splat}', …), which keeps the same GET-only behavior.
• __test__/api-unknown-route.test.js: a new test checks that an unknown nested path returns 404 Not Found.
• I checked the other routes (/:id, /list, …) and the req.query usage. They need no changes under Express 5.

Runtime and Babel 8 changes

• Dockerfile: node:20 → node:24. .github/workflows/tests.yaml: node-version: '20' → '24'. This reverses the Node 20 pin from Update dependencies and align Docker runtime #251. Node 20 is now EOL.
• .babelrc: Babel 8 removed the regenerator option from @babel/plugin-transform-runtime, so I dropped it. The plugin is otherwise unchanged.
• README.md: the prerequisites now say Node.js 24 is recommended and that Babel 8 needs ^22.18.0 || >=24.11.0.
• Lockfile: only the Babel dependency tree changed. Every other package keeps its resolved version.

Validation

Everything ran in a node:24 container (Node v24.21.0, npm 11.19.0) against a dedicated local Couchbase Enterprise 7.6.4 with travel-sample loaded (63,288 docs, all indexes online).

rm -rf node_modules dist
npm ci && npm ls --depth=0 && npm audit && npm test && npm run build
docker build -t nqs-app . && docker run --env-file config/dev.env nqs-app   # node:24 image, `npm start` via babel-node 8
# Playwright Swagger walkthrough against the running container

Gate	Result
npm ci from the regenerated lockfile	✅ Passed. Lockfile is still v2.
npm audit	✅ 0 vulnerabilities
npm test (integration, Jest)	✅ 20/20 suites, 20/20 tests passed
npm run build	✅ Babel 8 compiled 10 files
docker build + run (node:24)	✅ Container reports Node v24.21.0. npm start (nodemon + babel-node 8) serves the API.
Swagger UI	✅ "Try it out" on GET /api/v1/airline/list?country=France&limit=3 returned a live 200 from Couchbase
Catch-all route	✅ GET /api/v1/does-not-exist returns 404 Not Found

Evidence

Swagger UI (Node 24, Express 5.2.1, Babel 8)

Live request via Swagger "Try it out": GET /api/v1/airline/list?country=France&limit=3 → 200

Catch-all route: GET /api/v1/does-not-exist → 404 Not Found

Walkthrough video

Open the Swagger walkthrough (webm)

Risk

Medium. There are three major bumps. Express 4 → 5 only broke the wildcard route, which is fixed and covered by a test. Babel 7 → 8 only needed the .babelrc option removed. Node 20 → 24 means contributors on Node 20 must upgrade, which the README now states. The full integration suite, the build, the Docker image, and a live Swagger run all pass on Node 24.

Rollback

Revert this PR to restore the previous package.json, package-lock.json, src/app.js, .babelrc, Dockerfile, workflow, and README. To keep Express 5 but go back to Node 20, revert only 1f9f790.

---

Hermes tasks: t_0a387133, t_5e4f3c90 (board couchbase-examples)

🤖 Generated with Claude Code

[ejscribner]

@dex-the-ai I notice we skipped over some dependencies (we can see there are a lot more that are eligible based on the open dependabot PRs). Can you bump these as well (we'll let it supercede the dependabot PRs) and rework the evidence?

[dex-the-ai]

@ejscribner Done. I pushed 3b0d033, which adds the updates from the open Dependabot PRs, and I've redone the evidence in the PR description.

Now included

• express ^4.22.2 → ^5.2.1. This replaces chore(deps): bump express from 4.22.2 to 5.2.1 #240 and chore(deps): bump qs and express #256, and also covers what the human-authored chore(deps): update express to 5.2.1 #252 does. Express 5 needed one code change: the catch-all route becomes app.get('/{*splat}', …) because path-to-regexp v8 no longer accepts a bare *. I added a test for the 404 route.
• Transitive updates via npm update (no --force): qs 6.16.0 (chore(deps): bump qs and express #256), tar 7.5.22 (chore(deps): bump tar from 7.5.19 to 7.5.22 #254), brace-expansion 1.1.21 / 2.1.7 / 5.0.12 (chore(deps): bump brace-expansion #255). body-parser goes from 1.20.x to 2.3.0 through Express 5, which replaces chore(deps): bump body-parser from 1.20.5 to 1.20.6 #253.
• The jest, prettier, and supertest bumps from before (chore(deps-dev): bump jest from 30.4.2 to 30.5.2 #238).

Still skipped: Babel 8 (#239). It needs Node ^22.18 || >=24.11, and CI and the Dockerfile were deliberately kept on Node 20 in #251. If you want to move the runtime to Node 24, I can add that and Babel 8 here.

Validation (node:20, npm 10.8.2, against a local Couchbase 7.6.4 with travel-sample loaded):

• npm ci passed.
• npm audit: 0 vulnerabilities.
• npm test: 20/20 passed.
• npm run build passed.
• Playwright walkthrough of Swagger: a live GET /api/v1/airline/list?country=France returned 200, and an unknown route returned 404.

Screenshots and the video are in the PR description. Once this merges, #238, #240, #253, #254, #255, and #256 can be closed, and probably #252 too.

[ejscribner]

@dex-the-ai should we update the nodejs runtime then?

[dex-the-ai]

@ejscribner Yes. Node 20 reached end-of-life on 2026-04-30, so it doesn't get security fixes anymore, and Node 24 is the current Active LTS. I pushed 1f9f790, which moves the runtime to Node 24 and adds Babel 8 (#239).

Changes

• Dockerfile: node:20 → node:24. .github/workflows/tests.yaml: node-version '20' → '24'. This undoes the Node 20 pin from Update dependencies and align Docker runtime #251.
• Babel @babel/{cli,core,node,plugin-transform-runtime,preset-env} ^7.29.7 → ^8.0.6, and @babel/runtime → ^8.0.5. In the lockfile, only the Babel dependency tree changed.
• .babelrc: I removed the transform-runtime regenerator option. Babel 8 removed it, and the build fails if it's still set.
• README.md: the prerequisites now say Node 24 is recommended. Babel 8 needs ^22.18.0 || >=24.11.0, so Node 20 users will need to upgrade.

Validation (node:24, Node v24.21.0 / npm 11.19.0, against a local Couchbase 7.6.4 with travel-sample loaded):

• npm ci passed.
• npm audit: 0 vulnerabilities.
• npm test: 20/20 passed.
• npm run build: Babel 8 compiled 10 files.
• docker build + run: the container reports Node v24.21.0, and npm start via babel-node 8 serves the API.
• Playwright walkthrough of Swagger: a live GET /api/v1/airline/list?country=France returned 200, and an unknown route returned 404.

The PR description has the refreshed evidence and the walkthrough video. With this in, #239 can be closed along with the other superseded Dependabot PRs. If you'd rather keep Node 20 for now, reverting 1f9f790 alone keeps everything else in the PR.