chore(server): bump nestjs and express (#11259)

packages/backend/server/package.json

@@ -26,24 +26,24 @@
   },
   "dependencies": {
     "@ai-sdk/google": "^1.1.19",
-    "@apollo/server": "^4.11.2",
+    "@apollo/server": "^4.11.3",
     "@aws-sdk/client-s3": "^3.709.0",
     "@fal-ai/serverless-client": "^0.15.0",
     "@google-cloud/opentelemetry-cloud-monitoring-exporter": "^0.20.0",
     "@google-cloud/opentelemetry-cloud-trace-exporter": "^2.4.1",
     "@google-cloud/opentelemetry-resource-util": "^2.4.0",
-    "@nestjs-cls/transactional": "^2.4.4",
-    "@nestjs-cls/transactional-adapter-prisma": "^1.2.7",
-    "@nestjs/apollo": "^12.2.2",
-    "@nestjs/bullmq": "^10.2.3",
-    "@nestjs/common": "^10.4.15",
-    "@nestjs/core": "^10.4.15",
-    "@nestjs/graphql": "^12.2.2",
-    "@nestjs/platform-express": "^10.4.15",
-    "@nestjs/platform-socket.io": "^10.4.15",
-    "@nestjs/schedule": "^4.1.2",
-    "@nestjs/throttler": "6.4.0",
-    "@nestjs/websockets": "^10.4.15",
+    "@nestjs-cls/transactional": "^2.6.1",
+    "@nestjs-cls/transactional-adapter-prisma": "^1.2.19",
+    "@nestjs/apollo": "^13.0.4",
+    "@nestjs/bullmq": "^11.0.2",
+    "@nestjs/common": "^11.0.12",
+    "@nestjs/core": "^11.0.12",
+    "@nestjs/graphql": "^13.0.4",
+    "@nestjs/platform-express": "^11.0.12",
+    "@nestjs/platform-socket.io": "^11.0.12",
+    "@nestjs/schedule": "^5.0.1",
+    "@nestjs/throttler": "^6.4.0",
+    "@nestjs/websockets": "^11.0.12",
     "@node-rs/argon2": "^2.0.2",
     "@node-rs/crc32": "^1.10.6",
     "@opentelemetry/api": "^1.9.0",
@@ -73,7 +73,7 @@
     "dotenv": "^16.4.7",
     "eventemitter2": "^6.4.9",
     "eventsource-parser": "^3.0.0",
-    "express": "^4.21.2",
+    "express": "^5.0.1",
     "fast-xml-parser": "^5.0.0",
     "get-stream": "^9.0.1",
     "graphql": "^16.9.0",
@@ -120,7 +120,8 @@
     "@faker-js/faker": "^9.6.0",
     "@nestjs/testing": "patch:@nestjs/testing@npm%3A10.4.15#~/.yarn/patches/@nestjs-testing-npm-10.4.15-d591a1705a.patch",
     "@types/cookie-parser": "^1.4.8",
-    "@types/express": "^4.17.21",
+    "@types/express": "^5.0.1",
+    "@types/express-serve-static-core": "^5.0.6",
     "@types/graphql-upload": "^17.0.0",
     "@types/http-errors": "^2.0.4",
     "@types/lodash-es": "^4.17.12",

packages/backend/server/src/core/doc-renderer/controller.ts

@@ -60,7 +60,7 @@ export class DocRendererController {
   }
 
   @Public()
-  @Get('/*')
+  @Get('/*path')
   async render(@Req() req: Request, @Res() res: Response) {
     const assets: HtmlAssets =
       env.namespaces.canary &&

packages/backend/server/src/core/selfhost/static.ts

@@ -62,7 +62,7 @@ export class StaticFilesResolver implements OnModuleInit {
 
     // fallback all unknown routes
     app.get(
-      [basePath + '/admin', basePath + '/admin/*'],
+      [basePath + '/admin', basePath + '/admin/*path'],
       this.check.use,
       (_req, res) => {
         res.sendFile(
@@ -101,11 +101,13 @@ export class StaticFilesResolver implements OnModuleInit {
         redirect: false,
         index: false,
         fallthrough: true,
+        immutable: true,
+        dotfiles: 'ignore',
       })
     );
 
     // fallback all unknown routes
-    app.get([basePath, basePath + '/*'], this.check.use, (req, res) => {
+    app.get([basePath, basePath + '/*path'], this.check.use, (req, res) => {
       const mobile =
         env.namespaces.canary &&
         isMobile({