[Snyk] Fix for 2 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• examples/Portico/google-pay/package.json
• examples/Portico/google-pay/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncaught Exception SNYK-JS-QS-19432019	738
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-19432017	708

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncaught Exception
🦉 Allocation of Resources Without Limits or Throttling

[macroscope-cloud]

This upgrade includes major versions for both express (4.x → 5.x) and its dependency body-parser (1.x → 2.x). Both introduce significant breaking changes that require code modifications and thorough testing.

Express 5.x Breaking Changes

• Node.js Requirement: Express 5 requires Node.js v18 or newer. [4, 7, 8]
• Removed & Renamed Methods: Several deprecated methods have been removed. [3, 8]
  • app.del() has been replaced by app.delete().
  • req.param(name) has been removed. You must now explicitly use req.params, req.body, or req.query. [6, 8]
  • Methods like req.acceptsCharset() have been pluralized to req.acceptsCharsets(). [3, 8]
• Routing Changes: The route path matching has been updated for security and clarity. [3, 4, 5]
  • Inline regular expressions in routes (e.g., /:id(\\d+)) are no longer supported to prevent ReDoS vulnerabilities.
  • The syntax for wildcards and optional parameters has changed.
• Async Error Handling: Express 5 now automatically catches errors from async route handlers and forwards them to error-handling middleware, which may change application behavior if you relied on try/catch blocks. [5, 7]

body-parser 2.x Breaking Changes

• req.body Behavior: For requests with no body, req.body will now be undefined instead of an empty object ({}). Code that assumes req.body is always an object (e.g., if (req.body.property)) will fail and must be updated (e.g., if (req.body?.property)). [13, 15]
• Middleware Usage: The generic bodyParser() middleware has been removed. You must use specific middleware like bodyParser.json() or bodyParser.urlencoded(). [13]
• urlencoded Default: The extended option for bodyParser.urlencoded() now defaults to false. This can change how form data is parsed. [13]

Recommendation:

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.