Upgrade all packages to latest stable (Express 5, React 19.3, Vite 8.3, GitHub Actions)

[Copilot]

Brings every declared dependency — backend npm, website npm, and pinned GitHub Actions — up to its latest stable release. The only non-cosmetic upgrade is Express 4 → 5, which requires swapping the Apollo integration package.

Backend (package.json)

• express ^4.21.2 → ^5.2.1, with @as-integrations/express4 replaced by @as-integrations/express5 (the express4 integration declares an express@^4 peer).
• cors ^2.8.5 → ^2.8.6, graphql ^16.10.0 → ^16.14.2; @apollo/server and @graphql-tools/schema ranges pinned to current latest.
• graphql stays on 16.x deliberately: @apollo/server@5.5.1 declares peer graphql@^16.11.0, so graphql@17 fails to resolve. 16.14.2 is the newest compatible stable.
• Lockfile refresh pulled transitive qs to 6.16.0, which makes the open Dependabot PR Bump qs from 6.15.3 to 6.16.0 in the npm_and_yarn group across 1 directory #29 redundant.

The integration swap is the entire code change:

// src/index.js (and test/cors.test.js)
-import { expressMiddleware } from '@as-integrations/express4';
+import { expressMiddleware } from '@as-integrations/express5';

No route, middleware, or query-parsing code needed adjusting — there are no wildcard/optional path patterns, and req.query is only read as flat key/value pairs.

Website (website/package.json)

• react/react-dom → 19.3.0, @types/react/@types/react-dom → 19.3.0, @vitejs/plugin-react → 6.1.1, oxlint → 1.85.0, vite → 8.3.0.
• The displayed JavaScript sample imported expressMiddleware from @apollo/server/express4, a subpath Apollo Server 5 no longer exports; updated to @as-integrations/express5 so the sample matches the actual stack.

CI (.github/workflows)

• checkout v4→v7, setup-node v4→v7, configure-pages v5→v6, upload-pages-artifact v3→v5, deploy-pages v4→v5. Every input and output referenced by the workflows still exists in the new majors; node-version: 22 is unchanged.

Docs

• README stack section now reads Express 5 / @as-integrations/express5.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Website tooling requires newer Node 20 versions than the currently documented minimum.

Review effort: Lite
Findings: None

What changed in this PR

Upgrades backend, website, and CI dependencies, including migration from Express 4 to Express 5.

Changes:

• Updates npm dependencies and lockfiles.
• Replaces the Express 4 Apollo integration with @as-integrations/express5.
• Updates React, Vite, GitHub Actions, documentation, and examples.

File	Description
website/​src/​backendSamples.js	Updates the displayed Express integration example.
website/​package.json	Upgrades website dependencies.
website/​package-lock.json	Refreshes the website lockfile.
test/​cors.test.js	Updates the integration import.
src/​index.js	Uses the Express 5 integration.
README.md	Documents the Express 5 stack.
package.json	Upgrades backend dependencies.
package-lock.json	Refreshes the backend lockfile.
.github/​workflows/​deploy-pages.yml	Updates Pages deployment actions.
.github/​workflows/​ci.yml	Updates CI actions.

Files not reviewed (1)

• website/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.