Update dev express server to v5

dev-server/serve-dev.js

@@ -144,7 +144,7 @@ export function serveDev(port, config) {
   // The optional suffix allows the same PDF to be accessed at different URLs.
   // This is helpful for testing that annotations/real-time updates etc. work
   // based on the document fingerprint as well as the URL.
-  app.get('/pdf/:pdf/:suffix?', (req, res, next) => {
+  app.get('/pdf/:pdf{/:suffix}', (req, res, next) => {
     const pdfPath = `${PDF_PATH}${req.params.pdf}.pdf`;
 
     if (fs.existsSync(pdfPath)) {
@@ -175,7 +175,7 @@ export function serveDev(port, config) {
   });
 
   // Serve UI component playground
-  app.get('/ui-playground/:path?', (req, res) => {
+  app.get('/ui-playground{/:path}', (req, res) => {
     res.render('ui-playground', {
       resourceRoot:
         'http://localhost:3001/hypothesis/1.0.0-dummy-version/build',

package.json

@@ -64,7 +64,7 @@
     "eslint-plugin-mocha": "^10.0.1",
     "eslint-plugin-react": "^7.12.4",
     "eslint-plugin-react-hooks": "^4.0.4",
-    "express": "^4.14.1",
+    "express": "^5.0.1",
     "fancy-log": "^2.0.0",
     "fetch-mock": "11",
     "focus-visible": "^5.0.0",
@@ -81,7 +81,7 @@
     "lodash.debounce": "^4.0.3",
     "mocha": "10.7.3",
     "mustache": "^4.0.1",
-    "mustache-express": "^1.3.0",
+    "mustache-express": "^1.3.2",
     "npm-packlist": "^9.0.0",
     "postcss": "^8.0.3",
     "preact": "^10.4.0",