fix(FFESUPPORT-753): address open Dependabot vulnerabilities

Makefile

@@ -41,7 +41,7 @@ test-data:
 
 ## test
 .PHONY: test
-test: test test-data
+test: test-data
 	yarn test:unit
 
 ## prepare

jest.config.js

@@ -9,7 +9,6 @@ module.exports = {
   transform: {
     '^.+\\.(t|j)s$': ['ts-jest', { isolatedModules: true }],
   },
-  globalSetup: './test/globalSetup.ts',
   collectCoverageFrom: ['**/*.(t|j)s'],
   coverageDirectory: 'coverage/',
   testEnvironment: 'node',

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eppo/node-server-sdk",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "Eppo node server SDK",
   "main": "dist/index.js",
   "files": [
@@ -14,7 +14,7 @@
     "prepare": "make prepare",
     "pre-commit": "lint-staged && tsc && yarn docs",
     "typecheck": "tsc",
-    "test": "yarn test:unit",
+    "test": "make test",
     "test:unit": "NODE_ENV=test jest '.*\\.spec\\.ts'",
     "docs": "api-documenter markdown -i ./temp -o ./docs"
   },
@@ -32,10 +32,8 @@
     "@eppo/js-client-sdk-common": "^5"
   },
   "devDependencies": {
-    "@google-cloud/storage": "^7",
     "@microsoft/api-documenter": "^7.30.5",
     "@microsoft/api-extractor": "^7.58.7",
-    "@types/express": "^5",
     "@types/jest": "^30",
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
@@ -45,7 +43,6 @@
     "eslint-plugin-import": "^2",
     "eslint-plugin-prettier": "^5",
     "eslint-plugin-promise": "^7",
-    "express": "^5",
     "husky": "^9",
     "jest": "^30",
     "lint-staged": "^16",
@@ -60,9 +57,9 @@
   },
   "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e",
   "resolutions": {
-    "//@types/node": "Pinned to ^20 to keep the dev type surface aligned with engines.node >=20.x; newer @types/node would let consumer code use APIs that aren't actually available on Node 20",
-    "@types/node": "^20.0.0",
-    "//@tootallnate/once": "GHSA-rj4j-rrv4-3xc4 (low). Pulled deeply by @google-cloud/storage → teeny-request → http-proxy-agent. The latest @google-cloud/storage (7.19.x) still ships the unpatched chain and there's no newer release; the chain is dev-only (test fixture downloader)",
-    "@tootallnate/once": "^3.0.1"
+    "@types/node": "^20.0.0"
+  },
+  "resolutionRationales": {
+    "@types/node": "Pinned to ^20 to keep the dev type surface aligned with engines.node >=20.x; newer @types/node would let consumer code use APIs that are not available on Node 20."
   }
 }

test/mockApiServer.ts

@@ -1,4 +1,4 @@
-import * as express from 'express';
+import { createServer } from 'http';
 
 import {
   MOCK_BANDIT_MODELS_RESPONSE_FILE,
@@ -7,27 +7,38 @@ import {
   readMockResponse,
 } from './testHelpers';
 
-const api = express();
-
 export const TEST_SERVER_PORT = 4123;
 export const TEST_BANDIT_API_KEY = 'foo.ZWg9MTIzNDU2LmUudGVzdGluZy5lcHBvLmNsb3Vk';
 const flagEndpoint = /flag-config\/v1\/config*/;
 const banditEndpoint = /flag-config\/v1\/bandits*/;
 
-api.get(flagEndpoint, (req, res) => {
-  const ufcFile = req.url.includes(TEST_BANDIT_API_KEY)
-    ? MOCK_FLAGS_WITH_BANDITS_RESPONSE_FILE
-    : MOCK_UFC_RESPONSE_FILE;
-  const mockUfcResponse = readMockResponse(ufcFile);
-  res.json(mockUfcResponse);
-});
+const server = createServer((req, res) => {
+  if (req.method !== 'GET' || !req.url) {
+    res.statusCode = 404;
+    res.end();
+    return;
+  }
+
+  if (flagEndpoint.test(req.url)) {
+    const ufcFile = req.url.includes(TEST_BANDIT_API_KEY)
+      ? MOCK_FLAGS_WITH_BANDITS_RESPONSE_FILE
+      : MOCK_UFC_RESPONSE_FILE;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(readMockResponse(ufcFile)));
+    return;
+  }
+
+  if (banditEndpoint.test(req.url)) {
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(readMockResponse(MOCK_BANDIT_MODELS_RESPONSE_FILE)));
+    return;
+  }
 
-api.get(banditEndpoint, (req, res) => {
-  const mockBanditResponse = readMockResponse(MOCK_BANDIT_MODELS_RESPONSE_FILE);
-  res.json(mockBanditResponse);
+  res.statusCode = 404;
+  res.end();
 });
 
-const server = api.listen(TEST_SERVER_PORT, () => {
+server.listen(TEST_SERVER_PORT, () => {
   const address = server.address();
   console.log(`Running API server on '${JSON.stringify(address)}'...`);
 });