Bump remaining direct dependencies

Author: nulltoken

package.json

@@ -55,20 +55,20 @@
   "dependencies": {
     "basic-auth": "^2.0.1",
     "cors": "^2.8.5",
-    "express": "^4.21.2",
+    "express": "^5.1.0",
     "is-plain-object": "^5.0.0",
     "jose": "^5.10.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.26.0",
     "@types/basic-auth": "^1.1.6",
     "@types/cors": "^2.8.17",
-    "@types/express": "^4.17.21",
-    "@types/node": "^18.19.87",
+    "@types/express": "^5.0.1",
+    "@types/node": "^18.19.97",
     "@types/supertest": "^6.0.3",
     "@typescript-eslint/eslint-plugin": "^8.32.0",
     "@typescript-eslint/parser": "^8.32.0",
-    "@vitest/coverage-v8": "^3.1.2",
+    "@vitest/coverage-v8": "^3.1.3",
     "@vitest/eslint-plugin": "^1.1.44",
     "eslint": "^9.26.0",
     "eslint-config-prettier": "^10.1.3",
@@ -81,7 +81,7 @@
     "supertest": "^7.1.0",
     "typescript": "^5.8.3",
     "typescript-eslint": "^8.32.0",
-    "vitest": "^3.1.2"
+    "vitest": "^3.1.3"
   },
   "resolutions": {
     "@types/node": "^18"

src/lib/oauth2-service.ts

@@ -137,7 +137,7 @@ export class OAuth2Service extends EventEmitter {
   private buildRequestHandler = (): RequestListener => {
     const app = express();
     app.disable('x-powered-by');
-    app.use(json());
+    app.use(json({ strict: true }));
     app.use(cors());
     app.get(this.#endpoints.wellKnownDocument, this.openidConfigurationHandler);
     app.get(this.#endpoints.jwks, this.jwksHandler);
@@ -152,7 +152,7 @@ export class OAuth2Service extends EventEmitter {
     app.get(this.#endpoints.endSession, this.endSessionHandler);
     app.post(this.#endpoints.introspect, this.introspectHandler);
 
-    return app;
+    return app as RequestListener;
   };
 
   private openidConfigurationHandler: RequestHandler = (_req, res) => {

test/oauth2-server.test.ts

@@ -52,7 +52,7 @@ describe('OAuth 2 Server', () => {
       .post('/token')
       .set('Content-Type', 'multipart/form-data;');
 
-    expect(res.text).toContain("[ERR_ASSERTION]: Invalid 'grant_type' type");
+    expect(res.text).toContain("[ERR_ASSERTION]: Invalid token request body");
 
     await expect(server.stop()).resolves.not.toThrow();
   });