[Snyk] Fix for 2 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• examples/Portico/google-pay/package.json
• examples/Portico/google-pay/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncaught Exception SNYK-JS-QS-19432019	738
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-19432017	708

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncaught Exception

[macroscope-cloud]

This upgrade includes major versions for both express and body-parser, introducing significant and related breaking changes that require mandatory code modifications.

express@4.22.2 → express@5.1.0 (High Risk)

The upgrade to Express 5 is a major migration that modernizes the framework but removes or changes several core features.

Key Breaking Changes:

• Middleware Not Bundled: body-parser, cookie-parser, session, and other middleware are no longer included with Express. You must now install and apply them explicitly.
• req.body is undefined: Previously, req.body would be an empty object ({}) if no body was parsed. In Express 5, it is undefined, which can cause runtime errors.
• API and Method Changes:
  • app.del() has been removed. Use app.delete() instead.
  • req.param() is removed. Use req.params, req.body, or req.query directly.
  • Response signatures like res.send(status, body) are removed. Use the chained res.status(status).send(body) method.
• Promise Support: Asynchronous route handlers with rejected promises are now automatically caught, which may simplify error handling but could change existing logic.
• Node.js Requirement: Express 5 requires Node.js version 18 or newer.

body-parser@1.20.5 → body-parser@2.1.0 (High Risk)

This upgrade aligns with the changes in Express 5.

Key Breaking Changes:

• req.body Behavior: Consistent with Express 5, req.body will be undefined if no body is parsed, whereas v1 would initialize it to {}. This requires checking for req.body before accessing its properties.
• urlencoded Default: The extended option for bodyParser.urlencoded() now defaults to false.
• Node.js Requirement: body-parser v2 requires Node.js 18+.

Recommendation:

1. Run Express Codemods: Start by running npx @expressjs/codemod upgrade to automate many of the required syntax updates.
2. Explicitly Add Middleware: Ensure body-parser is added as a dependency and used explicitly in your application (e.g., app.use(bodyParser.json())).
3. Audit req.body Usage: Review all code that accesses req.body to handle cases where it might be undefined.
4. Verify Environment: Confirm your production and development environments are running Node.js 18 or later.
5. Test Thoroughly: Due to the number of breaking changes, a full regression test is strongly advised.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.