chore(): Fix dependencies (medusajs#13932)

Author: adrien2p

.changeset/tame-eels-cover.md

@@ -0,0 +1,19 @@
+---
+"@medusajs/medusa": patch
+"@medusajs/test-utils": patch
+"@medusajs/analytics-posthog": patch
+"@medusajs/file-s3": patch
+"@medusajs/notification-sendgrid": patch
+"@medusajs/draft-order": patch
+"@medusajs/framework": patch
+"@medusajs/utils": patch
+"create-medusa-app": patch
+"@medusajs/telemetry": patch
+"@medusajs/admin-bundler": patch
+"@medusajs/admin-vite-plugin": patch
+"@medusajs/icons": patch
+"@medusajs/toolbox": patch
+"@medusajs/ui": patch
+---
+
+chore(): Fix dependencies vulnerabilities

integration-tests/http/package.json

@@ -33,7 +33,7 @@
     "@medusajs/user": "workspace:^",
     "@medusajs/utils": "workspace:^",
     "@medusajs/workflow-engine-inmemory": "workspace:*",
-    "form-data": "^4.0.0",
+    "form-data": "^4.0.4",
     "jsonwebtoken": "^9.0.2",
     "pg": "^8.11.3"
   },

package.json

@@ -23,7 +23,7 @@
     "@types/node": "^20.12.11",
     "@typescript-eslint/eslint-plugin": "^6.19.0",
     "@typescript-eslint/parser": "^6.19.0",
-    "axios": "^1.12.0",
+    "axios": "^1.13.1",
     "axios-mock-adapter": "^1.19.0",
     "cross-env": "^7.0.3",
     "eslint": "^8.23.0",

packages/admin/admin-bundler/src/commands/serve.ts

@@ -42,7 +42,7 @@ export async function serve(options: ServeOptions) {
     res.setHeader("Vary", "Origin, Cache-Control")
   }
 
-  router.use(compression())
+  router.use(compression() as any)
 
   router.get("/", sendHtml)
   router.use(

packages/admin/admin-vite-plugin/package.json

@@ -41,7 +41,7 @@
     "@babel/traverse": "7.25.6",
     "@babel/types": "7.25.6",
     "@medusajs/admin-shared": "2.11.2",
-    "chokidar": "3.5.3",
+    "chokidar": "^3.5.3",
     "fdir": "6.1.1",
     "magic-string": "0.30.5",
     "outdent": "^0.8.0",

packages/cli/create-medusa-app/package.json

@@ -27,7 +27,7 @@
     "slugify": "^1.6.6",
     "uuid": "^9.0.0",
     "validator": "^13.15.20",
-    "wait-on": "^7.0.1",
+    "wait-on": "^9.0.1",
     "winston": "^3.9.0"
   },
   "devDependencies": {

packages/cli/create-medusa-app/src/utils/logger.ts

@@ -1,7 +1,7 @@
 import winston from "winston"
 
 const consoleTransport = new winston.transports.Console({
-  format: winston.format.printf((log) => log.message),
+  format: winston.format.printf((log) => log.message as string),
 })
 const options = {
   transports: [consoleTransport],

packages/core/framework/package.json

@@ -77,7 +77,7 @@
     "ioredis": "^5.4.1",
     "jest": "^29.7.0",
     "rimraf": "^5.0.1",
-    "supertest": "^4.0.2",
+    "supertest": "^7.1.4",
     "typescript": "^5.6.2",
     "vite": "^5.4.14"
   },
@@ -102,7 +102,7 @@
     "jsonwebtoken": "^9.0.2",
     "lodash.memoize": "^4.1.2",
     "morgan": "^1.9.1",
-    "path-to-regexp": "^0.1.12",
+    "path-to-regexp": "^8.2.0",
     "tsconfig-paths": "^4.2.0",
     "zod": "3.25.76",
     "zod-validation-error": "3.5.1"

packages/core/framework/src/http/routes-finder.ts

@@ -1,5 +1,6 @@
-import pathToRegexp from "path-to-regexp"
+import { pathToRegexp } from "path-to-regexp"
 import type { MiddlewareVerb, RouteVerb } from "./types"
+import { isString } from "@medusajs/utils"
 
 export class RoutesFinder<
   T extends
@@ -35,9 +36,17 @@ export class RoutesFinder<
    * Register route for lookup
    */
   add(route: T) {
+    // Doing a replacement for backwards compatibility with the old path-to-regexp with express 4
+    let normalizedPath = route.matcher
+    if (isString(route.matcher)) {
+      // Replace /* with {*splat} (wildcard matches zero or more path segments)
+      normalizedPath = normalizedPath.replace(/\/\*/g, "{*splat}")
+      // Replace /path* (no slash before asterisk) with /path{*splat}
+      normalizedPath = normalizedPath.replace(/(\w)\*/g, "$1{*splat}")
+    }
     this.#routes.push({
       ...route,
-      matchRegex: pathToRegexp(route.matcher),
+      matchRegex: pathToRegexp(normalizedPath).regexp,
     })
   }
 

packages/core/framework/src/http/utils/http-compression.ts

@@ -24,7 +24,7 @@ export function shouldCompressResponse(
   }
 
   // fallback to standard filter function
-  return compression.filter(req, res)
+  return compression.filter(req as any, res as any)
 }
 
 export function compressionOptions(