chore: drop the qs resolution and nine unused dependencies

webui/CHANGELOG.md

@@ -39,6 +39,8 @@ This change log covers only the frontend library (webui) of Open VSX.
 ### Dependencies
 
 - Remove the `react-dropzone` dependency; the publish page and the navbar's drop target handle their own drag events, and nothing else imports it
+- Remove nine dependencies nothing imports: `clsx`, `prop-types` and `punycode` from the runtime dependencies, and `@types/d3-scale`, `@types/d3-shape`, `@types/prop-types`, `@types/punycode`, `@types/react-transition-group` and `ts-node` from the development ones. All but `@types/punycode` and `ts-node` stay in the tree through MUI or the URL parsers that actually use them, so only those two leave the install
+- Bump express from `4.22.1` to `5.2.1` and `@types/express` from `4.17` to `5.0`. Express 4 caps `qs` at `~6.14.0`, which is why a `qs` resolution was needed to move past it; Express 5 declares `^6.14.0`, so that resolution is gone and `qs` resolves to `6.16.0` on its own. The standalone frontend server's catch-all route is now `/{*splat}`, which is how Express 5 spells the `*` it no longer accepts
 - Bump @humanfs/node from 0.16.6 to 0.16.8
 
 ## [v1.1.2] (20/08/2026)

webui/package.json

@@ -54,25 +54,22 @@
         "@tanstack/react-query": "^5.101.0",
         "@tanstack/react-query-devtools": "^5.101.0",
         "clipboard-copy": "^4.0.1",
-        "clsx": "^1.2.1",
         "dompurify": "^3.0.4",
         "fetch-retry": "^5.0.6",
         "lodash": "^4.17.21",
         "luxon": "^3.7.2",
         "markdown-it": "^14.1.0",
         "markdown-it-anchor": "^9.2.0",
-        "prop-types": "^15.8.1",
-        "punycode": "^2.3.0",
         "react": "^18.2.0",
         "react-avatar-editor": "^15.0.0",
         "react-dom": "^18.2.0",
         "react-helmet-async": "^2.0.5",
         "react-infinite-scroller": "^1.2.6",
         "react-router": "^7.18.2"
     },
+    "//resolutions": "@types/react-infinite-scroller declares its @types/react dependency as *, which resolves to v19 and puts a second copy of the React types in the tree; the pin below holds it at 18 until this app moves to React 19",
     "resolutions": {
-        "@types/react": "^18.2.14",
-        "qs": "^6.14.1"
+        "@types/react": "^18.2.14"
     },
     "devDependencies": {
         "@eslint/eslintrc": "^3.3.3",
@@ -82,20 +79,15 @@
         "@testing-library/jest-dom": "^7.0.0",
         "@testing-library/react": "^16.3.2",
         "@testing-library/user-event": "^14.6.1",
-        "@types/d3-scale": "^4.0",
-        "@types/d3-shape": "^3.1",
         "@types/dompurify": "^3.0.2",
-        "@types/express": "^4.17.21",
+        "@types/express": "^5.0.0",
         "@types/lodash": "^4.14.195",
         "@types/luxon": "^3.7.1",
         "@types/markdown-it": "^14.1.0",
         "@types/node": "^22.0.0",
-        "@types/prop-types": "^15.7.0",
-        "@types/punycode": "^2.1.0",
         "@types/react": "^18.2.0",
         "@types/react-dom": "^18.2.0",
         "@types/react-infinite-scroller": "^1.2.0",
-        "@types/react-transition-group": "^4.4.0",
         "@typescript-eslint/eslint-plugin": "^8.56.0",
         "@typescript-eslint/parser": "^8.56.0",
         "@vitejs/plugin-react": "^6.0.4",
@@ -106,13 +98,12 @@
         "eslint-plugin-react": "^7.37.0",
         "eslint-plugin-react-refresh": "^0.5.2",
         "eslint-plugin-testing-library": "^7.16.2",
-        "express": "^4.21.0",
+        "express": "^5.1.0",
         "express-rate-limit": "^7.4.0",
         "jsdom": "^30.0.0",
         "prettier": "^3.8.4",
         "rimraf": "^6.1.0",
         "rollup-plugin-visualizer": "^7.0.1",
-        "ts-node": "^10.9.2",
         "typescript": "^5.9.0",
         "vite": "^8.2.1",
         "vitest": "^4.1.10"

webui/src/default/server.ts

@@ -47,8 +47,9 @@ if (args.indexOf('-ratelimit') != -1) {
 const staticPath = path.join(__dirname, '..', '..', 'dist');
 app.use(express.static(staticPath));
 
-// Enable react-router by forwarding the main page to all paths that don't match a resource
-app.get('*', (req, res) => {
+// Enable react-router by forwarding the main page to all paths that don't match a resource.
+// The braces make the wildcard match the root path too, which a bare '/*splat' does not.
+app.get('/{*splat}', (req, res) => {
     res.sendFile(path.join(staticPath, 'index.html'));
 });