fix: bump dependencies to fix vulnerabilities (#2)

* fix: bump dependencies to fix vulnerabilities

Tests are broken above node 18.18.
There were significant changes in the path support (e.g. dropped support for regex).

* specific minor node version in .nvmrc

Author: mredele

.nvmrc

@@ -0,0 +1 @@
+v18.12

index.js

@@ -482,7 +482,7 @@ Router.prototype.use = function use(handler) {
 
     var layer = new Layer(path, {
       sensitive: this.caseSensitive,
-      strict: false,
+      trailing: !this.strict,
       end: false
     }, fn)
 
@@ -512,7 +512,7 @@ Router.prototype.route = function route(path) {
 
   var layer = new Layer(path, {
     sensitive: this.caseSensitive,
-    strict: this.strict,
+    trailing: !this.strict,
     end: true
   }, handle)
 

lib/layer.js

@@ -12,7 +12,7 @@
  * @private
  */
 
-var pathRegexp = require('path-to-regexp')
+var {pathToRegexp} = require('path-to-regexp')
 var debug = require('debug')('router:layer')
 
 /**
@@ -40,7 +40,9 @@ function Layer(path, options, fn) {
   this.name = fn.name || '<anonymous>'
   this.params = undefined
   this.path = undefined
-  this.regexp = pathRegexp(path, this.keys = [], opts)
+  var regexpResult = pathToRegexp(path,  opts)
+  this.keys = regexpResult.keys
+  this.regexp = regexpResult.regexp
 
   // set fast path flags
   this.regexp.fast_star = path === '*'

package.json

@@ -13,18 +13,18 @@
     "debug": "2.6.9",
     "methods": "~1.1.2",
     "parseurl": "~1.3.2",
-    "path-to-regexp": "0.1.7",
+    "path-to-regexp": "8.2.0",
     "setprototypeof": "1.1.1",
     "utils-merge": "1.0.1"
   },
   "devDependencies": {
     "after": "0.8.2",
-    "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.0-beta.6",
-    "finalhandler": "1.1.2",
+    "eslint": "8.57.1",
+    "eslint-plugin-markdown": "3.0.1",
+    "finalhandler": "2.1.0",
     "istanbul": "0.4.5",
-    "mocha": "2.5.3",
-    "supertest": "1.1.0"
+    "mocha": "10.8.2",
+    "supertest": "7.1.1"
   },
   "files": [
     "lib/",
@@ -34,7 +34,7 @@
     "index.js"
   ],
   "engines": {
-    "node": ">= 0.8"
+    "node": ">= 18"
   },
   "scripts": {
     "lint": "eslint --plugin markdown --ext js,md .",

test/req.params.js

@@ -136,33 +136,15 @@ describe('req.params', function () {
             sawParams(req, res)
           })
         })
-
-        router.get('/*', hitParams(1))
+        // https://expressjs.com/en/guide/migrating-5.html#path-syntax
+        router.get('/*asdf', hitParams(1))
 
         request(server)
         .get('/buzz')
-        .expect('x-params-1', '{"0":"foo","1":"bar","2":"buzz"}')
+        .expect('x-params-1', '{"0":"foo","1":"bar","asdf":"buzz"}')
         .expect(200, '{"0":"foo","1":"bar"}', done)
       })
 
-      it('should merge with same numeric properties', function (done) {
-        var router = Router({ mergeParams: true })
-        var server = createServer(function (req, res, next) {
-          req.params = {'0': 'foo'}
-
-          router(req, res, function (err) {
-            if (err) return next(err)
-            sawParams(req, res)
-          })
-        })
-
-        router.get('/*', hitParams(1))
-
-        request(server)
-        .get('/bar')
-        .expect('x-params-1', '{"0":"foo","1":"bar"}')
-        .expect(200, '{"0":"foo"}', done)
-      })
     })
   })
 })

test/route.js

@@ -192,7 +192,7 @@ describe('Router', function () {
 
       var body = method !== 'head'
         ? 'hello, world'
-        : ''
+        : undefined
 
       describe('.' + method + '(...fn)', function () {
         it('should respond to a ' + method.toUpperCase() + ' request', function (done) {
@@ -508,18 +508,19 @@ describe('Router', function () {
         it('should work following a partial capture group', function (done) {
           var cb = after(2, done)
           var router = new Router()
-          var route = router.route('/user(s)?/:user/:op')
+          var route = router.route('/user{s}/:user/:op')
           var server = createServer(router)
 
           route.all(sendParams)
 
+          // https://expressjs.com/en/guide/migrating-5.html#path-syntax
           request(server)
           .get('/user/tj/edit')
           .expect(200, {'user': 'tj', 'op': 'edit'}, cb)
 
           request(server)
           .get('/users/tj/edit')
-          .expect(200, {'0': 's', 'user': 'tj', 'op': 'edit'}, cb)
+          .expect(200, {'user': 'tj', 'op': 'edit'}, cb)
         })
 
         it('should work inside literal paranthesis', function (done) {
@@ -555,68 +556,68 @@ describe('Router', function () {
       describe('using "*"', function () {
         it('should capture everything', function (done) {
           var router = new Router()
-          var route = router.route('*')
+          var route = router.route('*name')
           var server = createServer(router)
 
           route.all(sendParams)
 
           request(server)
           .get('/foo/bar/baz')
-          .expect(200, {'0': '/foo/bar/baz'}, done)
+          .expect(200, {'name': '/foo/bar/baz'}, done)
         })
 
         it('should decode the capture', function (done) {
           var router = new Router()
-          var route = router.route('*')
+          var route = router.route('*name')
           var server = createServer(router)
 
           route.all(sendParams)
 
           request(server)
           .get('/foo/%20/baz')
-          .expect(200, {'0': '/foo/ /baz'}, done)
+          .expect(200, {'name': '/foo/ /baz'}, done)
         })
 
         it('should capture everything with pre- and post-fixes', function (done) {
           var router = new Router()
-          var route = router.route('/foo/*/bar')
+          var route = router.route('/foo/*name/bar')
           var server = createServer(router)
 
           route.all(sendParams)
 
           request(server)
           .get('/foo/1/2/3/bar')
-          .expect(200, {'0': '1/2/3'}, done)
+          .expect(200, {'name': '1/2/3'}, done)
         })
 
         it('should capture greedly', function (done) {
           var router = new Router()
-          var route = router.route('/foo/*/bar')
+          var route = router.route('/foo/*name/bar')
           var server = createServer(router)
 
           route.all(sendParams)
 
           request(server)
           .get('/foo/bar/bar/bar')
-          .expect(200, {'0': 'bar/bar'}, done)
+          .expect(200, {'name': 'bar/bar'}, done)
         })
 
-        it('should be an optional capture', function (done) {
+        it('regex characters are not supported', function (done) {
           var router = new Router()
-          var route = router.route('/foo*')
+          var route = router.route('/foo*name')
           var server = createServer(router)
 
           route.all(sendParams)
 
           request(server)
           .get('/foo')
-          .expect(200, {'0': ''}, done)
+          .expect(404, done)
         })
 
         it('should require preceeding /', function (done) {
           var cb = after(2, done)
           var router = new Router()
-          var route = router.route('/foo/*')
+          var route = router.route('/foo/{*name}')
           var server = createServer(router)
 
           route.all(sendParams)
@@ -630,39 +631,22 @@ describe('Router', function () {
           .expect(200, cb)
         })
 
-        it('should work in a named parameter', function (done) {
-          var cb = after(2, done)
-          var router = new Router()
-          var route = router.route('/:foo(*)')
-          var server = createServer(router)
-
-          route.all(sendParams)
-
-          request(server)
-          .get('/bar')
-          .expect(200, {'0': 'bar', 'foo': 'bar'}, cb)
-
-          request(server)
-          .get('/fizz/buzz')
-          .expect(200, {'0': 'fizz/buzz', 'foo': 'fizz/buzz'}, cb)
-        })
-
         it('should work before a named parameter', function (done) {
           var router = new Router()
-          var route = router.route('/*/user/:id')
+          var route = router.route('/*name/user/:id')
           var server = createServer(router)
 
           route.all(sendParams)
 
           request(server)
           .get('/poke/user/42')
-          .expect(200, {'0': 'poke', 'id': '42'}, done)
+          .expect(200, {'name': 'poke', 'id': '42'}, done)
         })
 
         it('should work within arrays', function (done) {
           var cb = after(3, done)
           var router = new Router()
-          var route = router.route(['/user/:id', '/foo/*', '/:action'])
+          var route = router.route(['/user/:id', '/foo/*name', '/:action'])
           var server = createServer(router)
 
           route.all(sendParams)
@@ -673,7 +657,7 @@ describe('Router', function () {
 
           request(server)
           .get('/foo/bar')
-          .expect(200, {'0': 'bar'}, cb)
+          .expect(200, {'name': 'bar'}, cb)
 
           request(server)
           .get('/poke')