chore(deps): update dependency @types/express-serve-static-core to v5

[backstage-goalie]

This PR contains the following updates:

Package	Type	Update	Change	Pending
@types/express-serve-static-core (source)	devDependencies	major	^4.17.5 -> ^5.0.0	5.0.3
@types/express-serve-static-core (source)	devDependencies	major	^4.17.5 -> ^5.0.0	5.0.3
@types/express-serve-static-core (source)	devDependencies	major	^4.17.5 -> ^5.0.0	5.0.3
@types/express-serve-static-core (source)	devDependencies	major	^4.17.5 -> ^5.0.0	5.0.3

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[backstage-goalie]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
backend	workspaces/3scale/packages/backend	none	v0.0.1

[awanlin]

Hi, for those tagged on this PR can you give this a quick look, please? It's a major version change just want to be sure. Thanks!

[04kash]

Since this is a type library, as long as the CI passes everything should be fine

[christoph-jerolimov]

@04kash I agree. On the otherside I would expect that this type is matching express v5. And as long backstage is using express v4 I don't expect that we should update this now and instead just close this PR anyway.

@04kash @awanlin And while checking this: I don't understand why this type is needed at all!

I guess it's a copy paste issue. At least a new backstage scaffold project doesn't need @types/express or @types/express-serve-static-core. And I just found one import of this package in the RBAC-Backend.

I like to create a PR that removes this dependency and aligns all the workspaces/*/packages/{app,backend}/package.json, when this is fine for you.

--
edit: You can find the first PRs below. I created multiple PRs to get it easier to test and review them:

[christoph-jerolimov]

First 6 PRs are created and ready for review; 13 more will come over the next days... 🤯

I hope it's fine that I close this PR now, otherwise the bot will push and build all these plugins again and again...

If you don't agree please let me know or reopen this PR.

[backstage-goalie]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 5.x releases. But if you manually upgrade to 5.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

[04kash]

First 6 PRs are created and ready for review; 13 more will come over the next days... 🤯

Thanks @christoph-jerolimov, if you need any help with the remaining PRs lmk!

[awanlin]

Hi @christoph-jerolimov @04kash, agree with closing this and working to remove the unused dependencies in the various impacted workspaces. Thanks for starting this @christoph-jerolimov.

In future could we perhaps log an issue for this so that way we can have a bit of discussion and engage the community to help? Though this is worthwhile to do there are a few other items that have higher priority that we could use both of your help with:

• Removing @backstage/backend-common as it has CVEs related to it, these plugins should be safe to start fully removing it now: 🙏 Help wanted: Deprecate old backend plugins #1176 (comment)
• There are still several plugins that have not been version bumped recently and are still on older versions of Backstage - 3scale, feedback, pingidentity, redhat-argocd, redhat-resource-optimization, report-portal, scaffolder-relation-processor, npm, and perhaps a few others that are not on this page yet: https://github.com/backstage/community-plugins/blob/main/docs/compatibility/compatibility.md
• Node 22 support. Backstage has supported 20 and 22 since the 1.33.0 release, we are lagging behind on this. The versions bumps would help. Also looking at the workspaces failing in this PR: Update Node.js to v22 #2403

Does that make sense?

[04kash]

Yup that sounds good, I can start taking a look at some of these next week