[Snyk] Security upgrade @google-cloud/functions-framework from 1.7.1 to 5.0.0

[caniszczyk]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• cmd/nodejs/functions_framework/converter/without-framework/package.json
• cmd/nodejs/functions_framework/converter/without-framework/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncaught Exception SNYK-JS-QS-19432019	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncaught Exception

[caniszczyk]

This is a major upgrade from version 1.7.1 to 5.0.0, spanning multiple breaking releases (v2, v3, v4, v5). This upgrade requires significant developer action due to fundamental changes in runtime requirements, event handling, and function signatures.

Key Breaking Changes:

• Node.js Runtime Requirement: The minimum required Node.js version has been significantly increased. Version 1.x supported older runtimes like Node.js 10, while version 3.x required Node.js 12+, and newer versions will require even more recent LTS releases. You must ensure your deployment environment uses a compatible Node.js version.

• Event-Driven Function Signature: The signature and payload for event-driven functions have changed. Version 1.x used a legacy event format. Newer versions (v2.0.0+) have standardized on the CloudEvents specification. This requires refactoring how event data is accessed.

  • Legacy (v1.x): (data, context) => {}
  • CloudEvents (v2.0.0+): The function receives a single CloudEvent object as an argument.

• HTTP Function Dependencies: The underlying Express.js dependency has been upgraded across these major versions. While many changes are internal, this could affect advanced use cases that interact directly with the Express request (req) and response (res) objects.

Recommendation:
This upgrade cannot be performed without code and environment changes. It is critical to:

1. Verify and upgrade your Node.js runtime to a version supported by the new framework.
2. Audit all event-driven functions and refactor them to handle the CloudEvents format instead of the legacy event format.
3. Thoroughly test all HTTP functions, paying close attention to request and response handling, especially if using custom middleware.

Source: Package documentation and release notes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}