v0.11.0 — Moleculer 0.15 support

[icebob-ai]

Summary

Major release aligning moleculer-web with Moleculer v0.15.x.

Breaking Changes

• Minimum Node.js 20 — Node 18 support dropped
• path-to-regexp upgraded to v8 — alias path syntax has changed (migration guide)
  • Optional params: /:name? → {/:name}
  • Repeating params: /*name → /:name*
• New streaming solution — multipart fields and request parameters are sent via ctx.params instead of meta, file stream available in ctx.stream
• Updated dependencies — many major/minor/patch upgrades

Bug Fixes

• fix: skip blacklisted actions in auto-alias regeneration (fix: skip blacklisted actions in auto-alias regeneration #366)
• fix: crash when upload file size exceeds limit (fix: crash when the upload file size exceeds the limit #363)
• fix: mergeParams for internal services — params were not merged on the current request (fix: #331 mergeParams always true for internal services #332)

Improvements

• Remove incorrect declare module "moleculer-web" wrapper from TypeScript definitions (based on this fixes typing issues for moeculer-web #357)
• Add tests for blacklist with autoAliases and mergeParams with internal services
• Add blacklist support for auto-aliases route filtering

Dependencies

• Update all dependencies (major: eslint 10, @sinonjs/fake-timers 15, @types/serve-static 2, cross-env 10, eslint-plugin-security 4, webpack-dev-middleware 8)
• Remove unused eslint-plugin-node, add @eslint/js and globals for ESLint 10

CI/CD

• Update Node.js CI matrix: 20.x, 22.x, 24.x
• Add npm publish workflow with OIDC provenance

Test plan

• All 299 tests passing
• ESLint clean (flat config, eslint 10)
• Manual testing with Moleculer 0.15.x application
• Verify npm publish workflow after OIDC trusted publisher setup

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates moleculer-web for compatibility with Moleculer v0.15.x, including the new streaming approach and the path-to-regexp v8 migration, alongside dependency/CI/tooling updates and formatting changes across tests/examples.

Changes:

• Update gateway internals for Moleculer v0.15 streaming (stream passed via call options; multipart fields/params via ctx.params).
• Migrate alias matching to path-to-regexp v8 API and refresh TypeScript typings.
• Modernize tooling: Node >= 20, ESLint 10 flat config, Prettier config, CI matrix and npm publish workflow.

Reviewed changes

Copilot reviewed 56 out of 61 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/index.js	Updates request handling, param merging logic, streaming call behavior, and server lifecycle/error handling.
src/alias.js	Migrates route regex generation to path-to-regexp v8; updates multipart handling to new streaming solution.
src/utils.js	Refactors helpers/formatting; adjusts minor behaviors (e.g., catch binding).
src/memory-store.js	Minor cleanup/formatting.
index.d.ts	Major rewrite of TS definitions, module augmentation, and exports to match new behaviors/deps.
package.json	Bumps version, raises Node engine, updates dependencies and scripts (ncu).
eslint.config.js	Adds ESLint flat config and Prettier integration.
prettier.config.js	Adds Prettier configuration.
.editorconfig	Updates formatting rules (md/yml indentation rules added).
.github/workflows/nodejs.yml	Updates CI Node.js version matrix.
.github/workflows/publish.yml	Adds npm publish workflow using provenance/OIDC.
CHANGELOG.md	Adds 0.11.0-beta4 notes and migration guidance entries.
test/unit/service/httpHandler.spec.js	Updates tests/formatting around requestId propagation and logging assertions.
test/unit/errors.spec.js	Minor cleanup.
test/services/test.service.js	Formatting + minor header/object literal tweaks in test service behaviors.
test/services/posts.service.js	Formatting-only changes.
test/services/multiRoute.service.js	Formatting-only changes.
test/services/math.service.js	Formatting-only changes.
examples/index.js	Minor formatting.
examples/simple/index.js	Formatting-only changes.
examples/www/index.js	Updates mixins usage to array + formatting.
examples/full/index.js	Updates mixins usage to array + formatting tweaks.
examples/rest/index.js	Updates mixins usage to array + formatting.
examples/routing/index.js	Updates mixins usage to array + formatting.
examples/raw/index.js	Updates mixins usage to array + formatting.
examples/ssl/index.js	Updates mixins usage to array + formatting.
examples/spdy/index.js	Updates mixins usage to array + formatting.
examples/socket.io/index.js	Formatting-only changes.
examples/express/index.js	Updates mixins usage to array + formatting.
examples/express/index2.js	Formatting-only changes.
examples/dev/index.js	Formatting-only changes.
examples/cors/index.js	Formatting-only changes.
examples/authorization/index.js	Updates mixins usage to array + formatting.
examples/authentication/index.js	Updates mixins usage to array + formatting.
examples/multi-auth/index.js	Updates mixins usage to array + formatting.
examples/middlewares/index.js	Updates service creation pattern + formatting.
examples/direct-calls/index.js	Updates service creation pattern + formatting.
examples/auto-aliases/index.js	Updates service creation pattern + formatting.
examples/sse/index.js	Formatting-only changes.
examples/sse/chat.service.js	Formatting-only changes.
examples/formidable/index.js	Updates formidable import/streaming parameter passing to match new streaming solution.
examples/file/index.js	Updates mixins usage to array + adds GET file alias.
examples/file.service.js	Updates mkdirp usage and switches to ctx.stream/ctx.params per new streaming solution.
examples/test.service.js	Formatting-only changes + minor rest schema formatting.
examples/post.service.js	Formatting-only changes.
examples/auth.service.js	Formatting-only changes.
examples/metrics.service.js	Formatting-only changes.
examples/math.service.js	Formatting-only changes.
examples/webpack/index.js	Formatting-only changes.
examples/webpack-vue/index.js	Formatting-only changes.
examples/webpack-vue/webpack.config.js	Formatting-only changes.
benchmarks/simple/index.js	Formatting-only changes.
benchmarks/cluster/index.js	Formatting-only changes.
benchmarks/cluster/worker.js	Formatting-only changes.
benchmarks/remote/api/index.js	Formatting-only changes.
benchmarks/remote/api/worker.js	Formatting-only changes.
benchmarks/remote/worker/index.js	Formatting-only changes.
benchmarks/remote/worker/worker.js	Formatting-only changes.
.eslintrc.js	Removed (replaced by flat config).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

In started(), if server.listen calls back with an error you call broker.fatal() but never resolve/reject the returned Promise. If broker.fatal doesn’t terminate the process (e.g., in tests or custom broker settings), service start can hang indefinitely. Consider rejecting the promise (or resolving after initiating shutdown) and keep fatal logging/exit as an option.