Skip to content

Upgrade Node.js to v24 and all npm dependencies#596

Open
jcheng5 wants to merge 4 commits into
masterfrom
replace-http-proxy-with-http-proxy-3
Open

Upgrade Node.js to v24 and all npm dependencies#596
jcheng5 wants to merge 4 commits into
masterfrom
replace-http-proxy-with-http-proxy-3

Conversation

@jcheng5

@jcheng5 jcheng5 commented Apr 14, 2026

Copy link
Copy Markdown
Member

Summary

  • Upgrade Node.js from v20.17.0 to v24.14.1
  • Replace unmaintained http-proxy with http-proxy-3, a maintained fork
  • Upgrade all npm dependencies to latest versions (except q, whose 2.x has been abandoned since 2015)
  • Major version bumps: express 5, send 1, ip-address 10, mocha 11, rewire 9, sinon 21, typescript 6, @types/node 25
  • Fix breaking changes from upgrades: send 1.x MIME API, TypeScript 6 async return types, sinon 21 fake timer scope
  • Add BlueOak-1.0.0 to approved licenses (permissive; used by mocha transitive deps)
  • Remove obsolete .npmrc (scripts-prepend-node-path was removed in npm 9)
  • Reduces npm audit vulnerabilities from 20 to 3 (all mocha transitive, dev-only)

Test plan

  • npm run build — TypeScript compiles cleanly
  • npm test — all 63 tests pass (verified on both Node 22 and Node 24)
  • tools/preflight.sh — license check and upstream check pass
  • Manual smoke test of app hosting on a Linux server

🤖 Generated with Claude Code

jcheng5 and others added 4 commits April 13, 2026 17:02
The original http-proxy package is unmaintained. Switch to http-proxy-3,
a maintained fork, and update NEWS for 1.5.24.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Major version bumps: express 5, send 1, ip-address 10, mocha 11,
rewire 9, sinon 21, typescript 6, @types/node 25.

Fixes required for the upgrades:
- send 1.x removed send.mime; use mime-types directly
- TypeScript 6 requires Promise<T> not Q.Promise<T> for async returns
- Sinon 21 fake timers now fake nextTick/queueMicrotask; scope to
  timer APIs only so Q promises still resolve in tests
- Add BlueOak-1.0.0 to approved licenses (permissive, used by
  mocha's transitive deps from isaacs)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This setting was removed in npm 9; the behavior is now always on.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@jcheng5 jcheng5 changed the title Replace http-proxy with http-proxy-3 and upgrade all deps Upgrade Node.js to v24 and all npm dependencies Apr 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant