[rush-serve-plugin] [lockfile-explorer] Upgrade express to 5.1.0

[cmalonzo]

Summary

Bump express version to 5.1.0, addressing npm audit report vulnerabilities as described in #5327

Details

Details in bug #5327

How it was tested

Testing lockfile-explorer

1. run `rush start` in `apps\lockfile-explorer`

Testing rush-serve-plugins

In progress

Impacted documentation

[dmichon-msft]

Do we know if this impacts compatibility with http2-express-bridge? Last publish of that package was 4 years ago.

[cmalonzo]

@dmichon-msft The @types/express version didnt need to change with the express bump and it looks like http2-express-bridge only depends on the former. Are there specific debug steps I can take to test this?

[dmichon-msft]

Temporarily:
Add a dependency on @rushstack/rush-serve-plugin here: https://github.com/microsoft/rushstack/blob/main/apps/rush/package.json
Add a line like this one for rush-serve-plugin:
https://github.com/microsoft/rushstack/blob/fea58ce44fa59872754df9edb51f265b750cfedf/apps/rush/src/start-dev.ts#L31C1-L31C47
rush update
rush build -t rush
Define a file at common/config/rush-plugins/rush-serve-plugin.json with content:

{
  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush-serve-plugin-options.schema.json",
  "phasedCommands": ["start"],
  "portParameterLongName": "--port",
  "globalRouting": [
    {
      "workspaceRelativeFolder": "rush.json",
      "servePath": "/"
    }
  ],
  "buildStatusWebSocketPath": "/ws",
  "logServePath": "/logs"
}

Also add the following entry in the parameters section of common/config/rush/command-line.json:

    {
      "longName": "--port",
      "argumentName": "PORT_NAME",
      "parameterKind": "integer",
      "description": "If specified, Rush will serve files on the specified port.",
      "associatedPhases": [],
      "associatedCommands": ["start"]
    },

Then run node ./apps/rush/lib/start-dev.js start --to module-minifier
Open the localhost link and verify that the path at / loads successfully and reports in the browser as being served via HTTP/2.

[dmichon-msft]

It appears that this value needs to be updated:

rushstack/rush-plugins/rush-serve-plugin/src/phasedCommandHandler.ts

Line 147 in fea58ce

'*',

[cmalonzo]

Abandoning for an alternative change