- Upgraded express from ^4.22.1 to ^5.2.1
- Added comprehensive Express 5 migration tests with TDD approach
- All 667 tests passing (663 existing + 4 new migration tests)
- No breaking changes detected in the codebase
- Express 5's native async error handling now active
- TypeScript compilation successful with @types/express ^5.0.6
Express 5 features now available:
- Automatic async error catching in route handlers
- Improved performance and stricter path matching
- Default export import style already in use
- basic-ftp: critical path traversal (GHSA-5rq4-664w-9x2c) - production dep via puppeteer
- rollup: high path traversal (GHSA-mw96-cpmx-2vgc) - dev dep via vitest
- npm audit now shows 0 vulnerabilities
- All 291 tests pass
swagger-jsdoc 7.0.0-rc.6 returns empty spec (0 paths), breaking /docs and /openapi.json.
Reverted to 6.2.8 which correctly generates all 10+ paths.
Added 2 regression tests to catch this in CI.
Task 1: Add JS minification to build pipeline (fix BUG-053)
- Update scripts/build-html.cjs to minify JS files in-place with terser
- Modified public/src/index.html and status.html to reference original JS files
- Add TDD test to verify JS minification works correctly
Task 2: Expand test coverage for untested routes
- Add tests for /v1/usage endpoint (auth required, admin access checks)
- Add tests for /v1/billing/checkout route (rate limiting, config checks)
- Add tests for rate limit headers on PDF conversion endpoints
- Add tests for 404 handler JSON error format for API vs HTML routes
- All tests follow TDD principles (RED → GREEN)
Task 3: Update swagger-jsdoc to fix npm audit vulnerability
- Upgraded swagger-jsdoc to 7.0.0-rc.6
- Resolved minimatch vulnerability via npm audit fix
- Verified OpenAPI generation still works correctly
- All 52 tests passing, 0 vulnerabilities remaining
Build improvements and security hardening complete.
- Refactor index.ts to skip start() when NODE_ENV=test
- Add test setup with mocks for db, keys, browser, verification, email, usage
- Add vitest.config.ts with setup file
- Rewrite tests to work with mocks (42 tests, all passing)
- Add new tests: signup 410, recovery validation, CORS headers, error format, API root
- Add test step to CI pipeline before Docker build
- Add scale, pageRanges, preferCSSPageSize, width, height to PdfOptions
- Add headerTemplate, footerTemplate, displayHeaderFooter to docs
- Pass all options through routes to browser service for HTML, Markdown, and URL endpoints
- Export PdfRenderOptions interface for type reuse
- Bump version to 0.4.5
- Add swagger-jsdoc dependency for auto-generating OpenAPI spec from JSDoc
- Add JSDoc @openapi annotations to all route handlers
- Create scripts/generate-openapi.mjs build step
- OpenAPI spec now auto-generated from code — no manual JSON editing
- All 13 endpoints documented with full parameters
- New demo endpoints documented, signup marked as deprecated
- Updated info description: demo-first, no free tier references
- Dockerfile updated to run openapi generation during build
- Build script updated: npm run build generates spec before compile
- BUG-055: Remove duplicate preconnect tags from homepage
- BUG-058: Add twitter:image meta tag to homepage
- BUG-060: Add og:title/description/url to sub-pages
- BUG-061: Add /status to sitemap.xml
- BUG-067: Add skip-to-content link on all pages
- BUG-069: Add legal footer to /docs page
- BUG-053: Minify app.js with terser
- Replace Resend email service with nodemailer via local postfix relay
- Remove code field from POST /v1/signup/free response
- Send 6-digit verification code via email only (noreply@docfast.dev)
- Add extra_hosts for Docker-to-host SMTP relay
- Fire-and-forget email sending to avoid blocking API response
