feat(node): upgrade express to v4.21.2 to address security vulnerabilities (#29419)

<!-- Please make sure you have read the submission guidelines before
posting an PR -->
<!--
https://github.com/nrwl/nx/blob/master/CONTRIBUTING.md#-submitting-a-pr
-->

<!-- Please make sure that your commit message follows our format -->
<!-- Example: `fix(nx): must begin with lowercase` -->

<!-- If this is a particularly complex change or feature addition, you
can request a dedicated Nx release for this pull request branch. Mention
someone from the Nx team or the `@nrwl/nx-pipelines-reviewers` and they
will confirm if the PR warrants its own release for testing purposes,
and generate it for you if appropriate. -->

## Current Behavior
<!-- This is the behavior we have today -->

## Expected Behavior
<!-- This is the behavior we should expect with the changes in this PR
-->
Nx should install and depend on a version of express without security
vulnerabilities.

## Related Issue(s)
<!-- Please link the issue being fixed so it gets closed when this is
merged. -->

Fixes #

Co-authored-by: Igor Loskutov <igor.loskutoff@gmail.com>
Co-authored-by: Colum Ferry <cferry09@gmail.com>

package.json

@@ -129,7 +129,7 @@
     "@types/ejs": "3.1.2",
     "@types/eslint": "~8.56.10",
     "@types/eslint__js": "^8.42.3",
-    "@types/express": "4.17.14",
+    "@types/express": "^4.17.21",
     "@types/flat": "^5.0.1",
     "@types/fs-extra": "^11.0.0",
     "@types/is-ci": "^3.0.0",
@@ -193,7 +193,7 @@
     "eslint-plugin-react": "7.35.0",
     "eslint-plugin-react-hooks": "5.0.0",
     "eslint-plugin-storybook": "^0.8.0",
-    "express": "^4.19.2",
+    "express": "^4.21.2",
     "fast-xml-parser": "^4.2.7",
     "figures": "3.2.0",
     "file-type": "^16.2.0",

packages/angular/src/utils/backward-compatible-versions.ts

@@ -35,8 +35,8 @@ export const backwardCompatibleVersions: VersionMap = {
     tsLibVersion: '^2.3.0',
     corsVersion: '~2.8.5',
     typesCorsVersion: '~2.8.5',
-    expressVersion: '~4.18.2',
+    expressVersion: '^4.21.2',
-    typesExpressVersion: '4.17.14',
+    typesExpressVersion: '^4.17.21',
     browserSyncVersion: '^3.0.0',
     moduleFederationNodeVersion: '~2.3.0',
     moduleFederationEnhancedVersion: '~0.2.3',
@@ -62,8 +62,8 @@ export const backwardCompatibleVersions: VersionMap = {
     tsLibVersion: '^2.3.0',
     corsVersion: '~2.8.5',
     typesCorsVersion: '~2.8.5',
-    expressVersion: '~4.18.2',
+    expressVersion: '^4.21.2',
-    typesExpressVersion: '4.17.14',
+    typesExpressVersion: '^4.17.21',
     browserSyncVersion: '^3.0.0',
     moduleFederationNodeVersion: '~2.5.0',
     moduleFederationEnhancedVersion: '0.6.9',

packages/angular/src/utils/versions.ts

@@ -11,8 +11,8 @@ export const tsLibVersion = '^2.3.0';
 
 export const corsVersion = '~2.8.5';
 export const typesCorsVersion = '~2.8.5';
-export const expressVersion = '~4.18.2';
+export const expressVersion = '^4.21.2';
-export const typesExpressVersion = '4.17.14';
+export const typesExpressVersion = '^4.17.21';
 export const browserSyncVersion = '^3.0.0';
 export const moduleFederationNodeVersion = '^2.6.21';
 export const moduleFederationEnhancedVersion = '^0.8.8';

packages/express/package.json

@@ -36,7 +36,7 @@
     "tslib": "^2.3.0"
   },
   "peerDependencies": {
-    "express": "^4.18.1"
+    "express": "^4.21.2"
   },
   "peerDependenciesMeta": {
     "express": {

packages/express/src/utils/versions.ts

@@ -1,4 +1,4 @@
 export const nxVersion = require('../../package.json').version;
 
-export const expressVersion = '^4.18.1';
+export const expressVersion = '^4.21.2';
-export const expressTypingsVersion = '4.17.13';
+export const expressTypingsVersion = '^4.17.21';

packages/module-federation/package.json

@@ -34,7 +34,7 @@
     "@module-federation/enhanced": "^0.8.8",
     "@module-federation/node": "^2.6.21",
     "@module-federation/sdk": "^0.8.8",
-    "express": "^4.19.2",
+    "express": "^4.21.2",
     "http-proxy-middleware": "^3.0.3"
   },
   "peerDependencies": {},

packages/node/migrations.json

@@ -37,6 +37,14 @@
         "@fastify/sensible": {
           "version": "~6.0.2",
           "alwaysAddToPackageJson": false
+        },
+        "express": {
+          "version": "^4.21.2",
+          "alwaysAddToPackageJson": false
+        },
+        "@types/express": {
+          "version": "^4.17.21",
+          "alwaysAddToPackageJson": false
         }
       }
     }

packages/node/src/utils/versions.ts

@@ -4,8 +4,8 @@ export const tslibVersion = '^2.3.0';
 
 export const typesNodeVersion = '~18.16.9';
 
-export const expressVersion = '~4.18.1';
+export const expressVersion = '^4.21.2';
-export const expressTypingsVersion = '~4.17.13';
+export const expressTypingsVersion = '^4.17.21';
 
 export const koaVersion = '~2.14.1';
 export const koaTypingsVersion = '~2.13.5';

packages/react/package.json

@@ -43,7 +43,7 @@
     "@nx/eslint": "file:../eslint",
     "@nx/web": "file:../web",
     "@nx/module-federation": "file:../module-federation",
-    "express": "^4.19.2",
+    "express": "^4.21.2",
     "http-proxy-middleware": "^3.0.3",
     "semver": "^7.6.3"
   },

packages/react/src/utils/versions.ts

@@ -53,8 +53,8 @@ export const tailwindcssVersion = '3.4.3';
 export const autoprefixerVersion = '10.4.13';
 
 // SSR and Module Federation
-export const expressVersion = '~4.18.2';
+export const expressVersion = '^4.21.2';
-export const typesExpressVersion = '4.17.17';
+export const typesExpressVersion = '^4.17.21';
 export const isbotVersion = '^3.6.5';
 export const corsVersion = '~2.8.5';
 export const typesCorsVersion = '~2.8.12';

packages/rspack/package.json

@@ -36,7 +36,7 @@
     "browserslist": "^4.21.4",
     "css-loader": "^6.4.0",
     "enquirer": "~2.3.6",
-    "express": "^4.19.2",
+    "express": "^4.21.2",
     "fork-ts-checker-webpack-plugin": "7.2.13",
     "http-proxy-middleware": "^3.0.3",
     "less-loader": "11.1.0",

pnpm-lock.yaml

@@ -330,7 +330,7 @@ importers:
         version: 20.4.0-beta.2(@babel/traverse@7.25.9)(@swc-node/register@1.9.1(@swc/core@1.5.7(@swc/helpers@0.5.11))(@swc/types@0.1.12)(typescript@5.7.3))(@swc/core@1.5.7(@swc/helpers@0.5.11))(@types/node@20.16.10)(nx@20.4.0-beta.2(@swc-node/register@1.9.1(@swc/core@1.5.7(@swc/helpers@0.5.11))(@swc/types@0.1.12)(typescript@5.7.3))(@swc/core@1.5.7(@swc/helpers@0.5.11)))(typescript@5.7.3)(verdaccio@5.32.2(encoding@0.1.13)(typanion@3.14.0))
       '@nx/rspack':
         specifier: 20.4.0-beta.2
-        version: 20.4.0-beta.2(c27aorexsdrmgu3zzw2ki4d6t4)
+        version: 20.4.0-beta.2(rtcgxicsh6hj7e7m4lkektkiau)
       '@nx/storybook':
         specifier: 20.4.0-beta.2
         version: 20.4.0-beta.2(@babel/traverse@7.25.9)(@swc-node/register@1.9.1(@swc/core@1.5.7(@swc/helpers@0.5.11))(@swc/types@0.1.12)(typescript@5.7.3))(@swc/core@1.5.7(@swc/helpers@0.5.11))(@types/node@20.16.10)(@zkochan/js-yaml@0.0.7)(cypress@13.13.0)(eslint@8.57.0)(nx@20.4.0-beta.2(@swc-node/register@1.9.1(@swc/core@1.5.7(@swc/helpers@0.5.11))(@swc/types@0.1.12)(typescript@5.7.3))(@swc/core@1.5.7(@swc/helpers@0.5.11)))(typescript@5.7.3)(verdaccio@5.32.2(encoding@0.1.13)(typanion@3.14.0))
@@ -390,7 +390,7 @@ importers:
         version: 1.1.6(@swc/helpers@0.5.11)
       '@rspack/dev-server':
         specifier: 1.0.9
-        version: 1.0.9(@rspack/core@1.1.6(@swc/helpers@0.5.11))(@types/express@4.17.14)(bufferutil@4.0.7)(webpack-cli@5.1.4(webpack-dev-server@5.0.4)(webpack@5.88.0))(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))
+        version: 1.0.9(@rspack/core@1.1.6(@swc/helpers@0.5.11))(@types/express@4.17.21)(bufferutil@4.0.7)(webpack-cli@5.1.4(webpack-dev-server@5.0.4)(webpack@5.88.0))(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))
       '@rspack/plugin-minify':
         specifier: ^0.7.5
         version: 0.7.5
@@ -464,8 +464,8 @@ importers:
         specifier: ^8.42.3
         version: 8.42.3
       '@types/express':
-        specifier: 4.17.14
+        specifier: ^4.17.21
-        version: 4.17.14
+        version: 4.17.21
       '@types/flat':
         specifier: ^5.0.1
         version: 5.0.5
@@ -656,8 +656,8 @@ importers:
         specifier: ^0.8.0
         version: 0.8.0(eslint@8.57.0)(typescript@5.7.3)
       express:
-        specifier: ^4.19.2
+        specifier: ^4.21.2
-        version: 4.21.0
+        version: 4.21.2
       fast-xml-parser:
         specifier: ^4.2.7
         version: 4.5.0
@@ -6901,9 +6901,6 @@ packages:
   '@types/express-serve-static-core@4.19.5':
     resolution: {integrity: sha512-y6W03tvrACO72aijJ5uF02FRq5cgDR9lUxddQ8vyF+GvmjJQqbzDcJngEjURc+ZsG31VI3hODNZJ2URj86pzmg==}
 
-  '@types/express@4.17.14':
-    resolution: {integrity: sha512-TEbt+vaPFQ+xpxFLFssxUDXj5cWCxZJjIcB7Yg0k0GMHGtgtQgpvx/MUQUeAkNbA9AAGrwkAsoeItdTgS7FMyg==}
-
   '@types/express@4.17.21':
     resolution: {integrity: sha512-ejlPM315qwLpaQlQDTjPdsUFSc6ZsP4AN6AlWnogPjQ7CVi7PYF3YVz+CY3jE2pwYf7E/7HlDAN0rV2GxTG0HQ==}
 
@@ -22811,7 +22808,7 @@ snapshots:
       - typescript
       - verdaccio
 
-  '@nx/rspack@20.4.0-beta.2(c27aorexsdrmgu3zzw2ki4d6t4)':
+  '@nx/rspack@20.4.0-beta.2(rtcgxicsh6hj7e7m4lkektkiau)':
     dependencies:
       '@module-federation/enhanced': 0.8.8(@rspack/core@1.1.6(@swc/helpers@0.5.11))(bufferutil@4.0.7)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.7.3)(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))
       '@module-federation/node': 2.6.22(@rspack/core@1.1.6(@swc/helpers@0.5.11))(bufferutil@4.0.7)(next@14.2.16(@babel/core@7.25.2)(@playwright/test@1.47.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.55.0))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.7.3)(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))
@@ -22821,7 +22818,7 @@ snapshots:
       '@nx/web': 20.4.0-beta.2(@babel/traverse@7.25.9)(@swc-node/register@1.9.1(@swc/core@1.5.7(@swc/helpers@0.5.11))(@swc/types@0.1.12)(typescript@5.7.3))(@swc/core@1.5.7(@swc/helpers@0.5.11))(@types/node@20.16.10)(nx@20.4.0-beta.2(@swc-node/register@1.9.1(@swc/core@1.5.7(@swc/helpers@0.5.11))(@swc/types@0.1.12)(typescript@5.7.3))(@swc/core@1.5.7(@swc/helpers@0.5.11)))(typescript@5.7.3)(verdaccio@5.32.2(encoding@0.1.13)(typanion@3.14.0))
       '@phenomnomnominal/tsquery': 5.0.1(typescript@5.7.3)
       '@rspack/core': 1.1.6(@swc/helpers@0.5.11)
-      '@rspack/dev-server': 1.0.9(@rspack/core@1.1.6(@swc/helpers@0.5.11))(@types/express@4.17.14)(bufferutil@4.0.7)(webpack-cli@5.1.4(webpack-dev-server@5.0.4)(webpack@5.88.0))(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))
+      '@rspack/dev-server': 1.0.9(@rspack/core@1.1.6(@swc/helpers@0.5.11))(@types/express@4.17.21)(bufferutil@4.0.7)(webpack-cli@5.1.4(webpack-dev-server@5.0.4)(webpack@5.88.0))(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))
       '@rspack/plugin-react-refresh': 1.0.0(react-refresh@0.10.0)
       autoprefixer: 10.4.13(postcss@8.4.38)
       browserslist: 4.24.2
@@ -23560,7 +23557,7 @@ snapshots:
       esbuild-plugins-node-modules-polyfill: 1.6.6(esbuild@0.17.6)
       execa: 5.1.1
       exit-hook: 2.2.1
-      express: 4.21.0
+      express: 4.21.2
       fs-extra: 10.1.0
       get-port: 5.1.1
       gunzip-maybe: 1.4.2
@@ -24002,13 +23999,13 @@ snapshots:
     optionalDependencies:
       '@swc/helpers': 0.5.15
 
-  '@rspack/dev-server@1.0.9(@rspack/core@1.1.6(@swc/helpers@0.5.11))(@types/express@4.17.14)(bufferutil@4.0.7)(webpack-cli@5.1.4(webpack-dev-server@5.0.4)(webpack@5.88.0))(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))':
+  '@rspack/dev-server@1.0.9(@rspack/core@1.1.6(@swc/helpers@0.5.11))(@types/express@4.17.21)(bufferutil@4.0.7)(webpack-cli@5.1.4(webpack-dev-server@5.0.4)(webpack@5.88.0))(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))':
     dependencies:
       '@rspack/core': 1.1.6(@swc/helpers@0.5.11)
       chokidar: 3.6.0
       connect-history-api-fallback: 2.0.0
-      express: 4.21.0
+      express: 4.21.2
-      http-proxy-middleware: 2.0.6(@types/express@4.17.14)
+      http-proxy-middleware: 2.0.6(@types/express@4.17.21)
       mime-types: 2.1.35
       p-retry: 4.6.2
       webpack-dev-middleware: 7.4.2(webpack@5.88.0(@swc/core@1.5.7(@swc/helpers@0.5.11))(esbuild@0.19.5)(webpack-cli@5.1.4))
@@ -24913,13 +24910,6 @@ snapshots:
       '@types/range-parser': 1.2.7
       '@types/send': 0.17.4
 
-  '@types/express@4.17.14':
-    dependencies:
-      '@types/body-parser': 1.19.5
-      '@types/express-serve-static-core': 4.19.5
-      '@types/qs': 6.9.16
-      '@types/serve-static': 1.15.7
-
   '@types/express@4.17.21':
     dependencies:
       '@types/body-parser': 1.19.5
@@ -25127,7 +25117,7 @@ snapshots:
 
   '@types/serve-index@1.9.4':
     dependencies:
-      '@types/express': 4.17.14
+      '@types/express': 4.17.21
 
   '@types/serve-static@1.15.7':
     dependencies:
@@ -30292,18 +30282,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  http-proxy-middleware@2.0.6(@types/express@4.17.14):
-    dependencies:
-      '@types/http-proxy': 1.17.15
-      http-proxy: 1.18.1(debug@4.3.7)
-      is-glob: 4.0.3
-      is-plain-obj: 3.0.0
-      micromatch: 4.0.8
-    optionalDependencies:
-      '@types/express': 4.17.14
-    transitivePeerDependencies:
-      - debug
-
   http-proxy-middleware@2.0.6(@types/express@4.17.21):
     dependencies:
       '@types/http-proxy': 1.17.15
@@ -37739,7 +37717,7 @@ snapshots:
       compression: 1.7.4
       connect-history-api-fallback: 2.0.0
       default-gateway: 6.0.3
-      express: 4.21.0
+      express: 4.21.2
       graceful-fs: 4.2.11
       html-entities: 2.5.2
       http-proxy-middleware: 2.0.6(@types/express@4.17.21)