cases / real-express-4-clean

real-express-4-clean

express 4.16.3 → 5.0.0

A real Express 4.16.3 REST API (~2.9k stars) upgraded to Express 5. It uses none of the removed APIs, so the correct output is zero findings.

npm real repo negative — the correct output is nothing kunalkapadia/express-mongoose-es6-rest-api @c2b142a ↗

grep-baseline

0 right 39 wrong

<0.1s · $0.00

agent · deepseek-v4-flash-free

0 right 0 wrong

33.9s · $0.00

What each detector said

One row per (file, symbol) site — the unit the scorer compares on. Ground truth comes from the case's hand-written labels.

39 sites · 39 where a detector is wrong

not broken config/express.js :body grep-baseline flagged agent · deepseek-v4-flash-free silent

req.body, unchanged and itself a recommended replacement for req.param().
4 matched lines · reasoning
```
   3  const bodyParser = require('body-parser');
  23  // parse body params and attache them to req.body
  39  expressWinston.requestWhitelist.push('body');
  40  expressWinston.responseWhitelist.push('body');
```
grep-baseline conf 0.50
'req.body' is named in the release notes and appears in 38 place(s) in this repo. No check was made that these are real call sites.
not broken config/express.js :json grep-baseline flagged agent · deepseek-v4-flash-free silent

bodyParser.json() middleware and single-argument res.json(). The removed form is the two-argument res.json(obj, status).
2 matched lines · reasoning
```
  24  app.use(bodyParser.json());
  81  res.status(err.status).json({
```
grep-baseline conf 0.50
'res.json' is named in the release notes and appears in 10 place(s) in this repo. No check was made that these are real call sites.
not broken config/express.js :params grep-baseline flagged agent · deepseek-v4-flash-free silent

req.params, unchanged and itself a recommended replacement for req.param().
1 matched line · reasoning
```
  23  // parse body params and attache them to req.body
```
grep-baseline conf 0.50
'req.params' is named in the release notes and appears in 2 place(s) in this repo. No check was made that these are real call sites.
not broken config/express.js :send grep-baseline flagged agent · deepseek-v4-flash-free silent

res.send('OK') with a string argument, plus supertest .send(payload) in tests. Neither is the removed numeric-status overload.
1 matched line · reasoning
```
  79  // error handler, send stacktrace only during development
```
grep-baseline conf 0.50
'res.send' is named in the release notes and appears in 7 place(s) in this repo. No check was made that these are real call sites.

not broken config/express.js :status grep-baseline flagged agent · deepseek-v4-flash-free silent

res.status() and an APIError status field. res.status is explicitly unchanged in v5.

6 matched lines · reasoning

   8  const httpStatus = require('http-status');
  45  colorStatus: true // Color the status code (default green, 3XX cyan, 4XX yellow, 5XX red).
  57  const error = new APIError(unifiedErrorMessage, err.status, true);
  60  const apiError = new APIError(err.message, err.status, err.isPublic);
  81  res.status(err.status).json({
  82  message: err.isPublic ? err.message : httpStatus[err.status],

grep-baseline conf 0.50

'res.status' is named in the release notes and appears in 18 place(s) in this repo. No check was made that these are real call sites.

not broken config/param-validation.js :body grep-baseline flagged agent · deepseek-v4-flash-free silent

req.body, unchanged and itself a recommended replacement for req.param().
3 matched lines · reasoning
```
   6  body: {
  14  body: {
  25  body: {
```
grep-baseline conf 0.50
'req.body' is named in the release notes and appears in 38 place(s) in this repo. No check was made that these are real call sites.
not broken config/param-validation.js :params grep-baseline flagged agent · deepseek-v4-flash-free silent

req.params, unchanged and itself a recommended replacement for req.param().
1 matched line · reasoning
```
  18  params: {
```
grep-baseline conf 0.50
'req.params' is named in the release notes and appears in 2 place(s) in this repo. No check was made that these are real call sites.
not broken config/winston.js :json grep-baseline flagged agent · deepseek-v4-flash-free silent

bodyParser.json() middleware and single-argument res.json(). The removed form is the two-argument res.json(obj, status).
1 matched line · reasoning
```
   6  json: true,
```
grep-baseline conf 0.50
'res.json' is named in the release notes and appears in 10 place(s) in this repo. No check was made that these are real call sites.
not broken index.js :query grep-baseline flagged agent · deepseek-v4-flash-free silent

req.query, unchanged and itself a recommended replacement for req.param().
2 matched lines · reasoning
```
  25  mongoose.set('debug', (collectionName, method, query, doc) => {
  26  debug(`${collectionName}.${method}`, util.inspect(query, false, 20), doc);
```
grep-baseline conf 0.50
'req.query' is named in the release notes and appears in 6 place(s) in this repo. No check was made that these are real call sites.
not broken index.route.js :Router grep-baseline flagged agent · deepseek-v4-flash-free silent

express.Router(), explicitly listed as unchanged in v5.
1 matched line · reasoning
```
   5  const router = express.Router(); // eslint-disable-line new-cap
```
grep-baseline conf 0.50
'express.Router' is named in the release notes and appears in 3 place(s) in this repo. No check was made that these are real call sites.
not broken index.route.js :send grep-baseline flagged agent · deepseek-v4-flash-free silent

res.send('OK') with a string argument, plus supertest .send(payload) in tests. Neither is the removed numeric-status overload.
1 matched line · reasoning
```
  11  res.send('OK')
```
grep-baseline conf 0.50
'res.send' is named in the release notes and appears in 7 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.controller.js :body grep-baseline flagged agent · deepseek-v4-flash-free silent

req.body, unchanged and itself a recommended replacement for req.param().
1 matched line · reasoning
```
  22  if (req.body.username === user.username && req.body.password === user.password) {
```
grep-baseline conf 0.50
'req.body' is named in the release notes and appears in 38 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.controller.js :json grep-baseline flagged agent · deepseek-v4-flash-free silent

bodyParser.json() middleware and single-argument res.json(). The removed form is the two-argument res.json(obj, status).
2 matched lines · reasoning
```
  26  return res.json({
  44  return res.json({
```
grep-baseline conf 0.50
'res.json' is named in the release notes and appears in 10 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.controller.js :param grep-baseline flagged agent · deepseek-v4-flash-free silent

JSDoc @param tags, a paramValidation import, and router.param() route middleware. None is the removed req.param() request accessor.
5 matched lines · reasoning
```
  14  * @param req
  15  * @param res
  16  * @param next
  38  * @param req
  39  * @param res
```
grep-baseline conf 0.50
'req.param' is named in the release notes and appears in 15 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.controller.js :status grep-baseline flagged agent · deepseek-v4-flash-free silent

res.status() and an APIError status field. res.status is explicitly unchanged in v5.
1 matched line · reasoning
```
   2  const httpStatus = require('http-status');
```
grep-baseline conf 0.50
'res.status' is named in the release notes and appears in 18 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.route.js :param grep-baseline flagged agent · deepseek-v4-flash-free silent

JSDoc @param tags, a paramValidation import, and router.param() route middleware. None is the removed req.param() request accessor.
1 matched line · reasoning
```
   4  const paramValidation = require('../../config/param-validation');
```
grep-baseline conf 0.50
'req.param' is named in the release notes and appears in 15 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.route.js :Router grep-baseline flagged agent · deepseek-v4-flash-free silent

express.Router(), explicitly listed as unchanged in v5.
1 matched line · reasoning
```
   8  const router = express.Router(); // eslint-disable-line new-cap
```
grep-baseline conf 0.50
'express.Router' is named in the release notes and appears in 3 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.test.js :body grep-baseline flagged agent · deepseek-v4-flash-free silent

req.body, unchanged and itself a recommended replacement for req.param().
6 matched lines · reasoning
```
  31  expect(res.body.message).to.equal('Authentication error');
  43  expect(res.body).to.have.property('token');
  44  jwt.verify(res.body.token, config.jwtSecret, (err, decoded) => {
  47  jwtToken = `Bearer ${res.body.token}`;
  61  expect(res.body.message).to.equal('Unauthorized');
  73  expect(res.body.message).to.equal('Unauthorized');
```
+1 more

grep-baseline conf 0.50
'req.body' is named in the release notes and appears in 38 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.test.js :send grep-baseline flagged agent · deepseek-v4-flash-free silent

res.send('OK') with a string argument, plus supertest .send(payload) in tests. Neither is the removed numeric-status overload.
2 matched lines · reasoning
```
  28  .send(invalidUserCredentials)
  40  .send(validUserCredentials)
```
grep-baseline conf 0.50
'res.send' is named in the release notes and appears in 7 place(s) in this repo. No check was made that these are real call sites.
not broken server/auth/auth.test.js :status grep-baseline flagged agent · deepseek-v4-flash-free silent

res.status() and an APIError status field. res.status is explicitly unchanged in v5.
1 matched line · reasoning
```
   2  const httpStatus = require('http-status');
```
grep-baseline conf 0.50
'res.status' is named in the release notes and appears in 18 place(s) in this repo. No check was made that these are real call sites.
not broken server/helpers/APIError.js :param grep-baseline flagged agent · deepseek-v4-flash-free silent

JSDoc @param tags, a paramValidation import, and router.param() route middleware. None is the removed req.param() request accessor.
3 matched lines · reasoning
```
  25  * @param {string} message - Error message.
  26  * @param {number} status - HTTP status code of error.
  27  * @param {boolean} isPublic - Whether the message should be visible to user or not.
```
grep-baseline conf 0.50
'req.param' is named in the release notes and appears in 15 place(s) in this repo. No check was made that these are real call sites.
not broken server/helpers/APIError.js :status grep-baseline flagged agent · deepseek-v4-flash-free silent

res.status() and an APIError status field. res.status is explicitly unchanged in v5.
6 matched lines · reasoning
```
   1  const httpStatus = require('http-status');
   7  constructor(message, status, isPublic) {
  11  this.status = status;
  26  * @param {number} status - HTTP status code of error.
  29  constructor(message, status = httpStatus.INTERNAL_SERVER_ERROR, isPublic = false) {
  30  super(message, status, isPublic);
```
grep-baseline conf 0.50
'res.status' is named in the release notes and appears in 18 place(s) in this repo. No check was made that these are real call sites.
not broken server/tests/misc.test.js :body grep-baseline flagged agent · deepseek-v4-flash-free silent

req.body, unchanged and itself a recommended replacement for req.param().
3 matched lines · reasoning
```
  29  expect(res.body.message).to.equal('Not Found');
  42  expect(res.body.message).to.equal('Internal Server Error');
  56  expect(res.body.message).to.equal('"username" is required');
```
grep-baseline conf 0.50
'req.body' is named in the release notes and appears in 38 place(s) in this repo. No check was made that these are real call sites.
not broken server/tests/misc.test.js :send grep-baseline flagged agent · deepseek-v4-flash-free silent

res.send('OK') with a string argument, plus supertest .send(payload) in tests. Neither is the removed numeric-status overload.
1 matched line · reasoning
```
  51  .send({
```
grep-baseline conf 0.50
'res.send' is named in the release notes and appears in 7 place(s) in this repo. No check was made that these are real call sites.
not broken server/tests/misc.test.js :status grep-baseline flagged agent · deepseek-v4-flash-free silent

res.status() and an APIError status field. res.status is explicitly unchanged in v5.
2 matched lines · reasoning
```
   2  const httpStatus = require('http-status');
  24  it('should return 404 status', (done) => {
```
grep-baseline conf 0.50
'res.status' is named in the release notes and appears in 18 place(s) in this repo. No check was made that these are real call sites.

not broken server/user/user.controller.js :body grep-baseline flagged agent · deepseek-v4-flash-free silent

req.body, unchanged and itself a recommended replacement for req.param().

6 matched lines · reasoning

  25  * @property {string} req.body.username - The username of user.
  26  * @property {string} req.body.mobileNumber - The mobileNumber of user.
  31  username: req.body.username,
  32  mobileNumber: req.body.mobileNumber
  42  * @property {string} req.body.username - The username of user.
  43  * @property {string} req.body.mobileNumber - The mobileNumber of user.

+2 more

grep-baseline conf 0.50

'req.body' is named in the release notes and appears in 38 place(s) in this repo. No check was made that these are real call sites.

not broken server/user/user.controller.js :json grep-baseline flagged agent · deepseek-v4-flash-free silent

bodyParser.json() middleware and single-argument res.json(). The removed form is the two-argument res.json(obj, status).
5 matched lines · reasoning
```
  20  return res.json(req.user);
  36  .then(savedUser => res.json(savedUser))
  52  .then(savedUser => res.json(savedUser))
  65  .then(users => res.json(users))
  76  .then(deletedUser => res.json(deletedUser))
```
grep-baseline conf 0.50
'res.json' is named in the release notes and appears in 10 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.controller.js :param grep-baseline flagged agent · deepseek-v4-flash-free silent

JSDoc @param tags, a paramValidation import, and router.param() route middleware. None is the removed req.param() request accessor.
1 matched line · reasoning
```
   9  req.user = user; // eslint-disable-line no-param-reassign
```
grep-baseline conf 0.50
'req.param' is named in the release notes and appears in 15 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.controller.js :query grep-baseline flagged agent · deepseek-v4-flash-free silent

req.query, unchanged and itself a recommended replacement for req.param().
3 matched lines · reasoning
```
  58  * @property {number} req.query.skip - Number of users to be skipped.
  59  * @property {number} req.query.limit - Limit number of users to be returned.
  63  const { limit = 50, skip = 0 } = req.query;
```
grep-baseline conf 0.50
'req.query' is named in the release notes and appears in 6 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.model.js :param grep-baseline flagged agent · deepseek-v4-flash-free silent

JSDoc @param tags, a paramValidation import, and router.param() route middleware. None is the removed req.param() request accessor.
3 matched lines · reasoning
```
  44  * @param {ObjectId} id - The objectId of user.
  61  * @param {number} skip - Number of users to be skipped.
  62  * @param {number} limit - Limit number of users to be returned.
```
grep-baseline conf 0.50
'req.param' is named in the release notes and appears in 15 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.model.js :status grep-baseline flagged agent · deepseek-v4-flash-free silent

res.status() and an APIError status field. res.status is explicitly unchanged in v5.
1 matched line · reasoning
```
   3  const httpStatus = require('http-status');
```
grep-baseline conf 0.50
'res.status' is named in the release notes and appears in 18 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.route.js :delete grep-baseline flagged agent · deepseek-v4-flash-free silent

router.delete(), which is the recommended replacement for the removed app.del.
1 matched line · reasoning
```
  23  .delete(userCtrl.remove);
```
grep-baseline conf 0.50
'app.delete' is named in the release notes and appears in 3 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.route.js :param grep-baseline flagged agent · deepseek-v4-flash-free silent

JSDoc @param tags, a paramValidation import, and router.param() route middleware. None is the removed req.param() request accessor.
2 matched lines · reasoning
```
   3  const paramValidation = require('../../config/param-validation');
  26  router.param('userId', userCtrl.load);
```
grep-baseline conf 0.50
'req.param' is named in the release notes and appears in 15 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.route.js :Router grep-baseline flagged agent · deepseek-v4-flash-free silent

express.Router(), explicitly listed as unchanged in v5.
1 matched line · reasoning
```
   6  const router = express.Router(); // eslint-disable-line new-cap
```
grep-baseline conf 0.50
'express.Router' is named in the release notes and appears in 3 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.test.js :body grep-baseline flagged agent · deepseek-v4-flash-free silent

req.body, unchanged and itself a recommended replacement for req.param().
6 matched lines · reasoning
```
  34  expect(res.body.username).to.equal(user.username);
  35  expect(res.body.mobileNumber).to.equal(user.mobileNumber);
  36  user = res.body;
  49  expect(res.body.username).to.equal(user.username);
  50  expect(res.body.mobileNumber).to.equal(user.mobileNumber);
  61  expect(res.body.message).to.equal('Not Found');
```
+6 more

grep-baseline conf 0.50
'req.body' is named in the release notes and appears in 38 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.test.js :delete grep-baseline flagged agent · deepseek-v4-flash-free silent

router.delete(), which is the recommended replacement for the removed app.del.
2 matched lines · reasoning
```
 110  it('should delete user', (done) => {
 112  .delete(`/api/users/${user._id}`)
```
grep-baseline conf 0.50
'app.delete' is named in the release notes and appears in 3 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.test.js :query grep-baseline flagged agent · deepseek-v4-flash-free silent

req.query, unchanged and itself a recommended replacement for req.param().
1 matched line · reasoning
```
  99  .query({ limit: 10, skip: 1 })
```
grep-baseline conf 0.50
'req.query' is named in the release notes and appears in 6 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.test.js :send grep-baseline flagged agent · deepseek-v4-flash-free silent

res.send('OK') with a string argument, plus supertest .send(payload) in tests. Neither is the removed numeric-status overload.
2 matched lines · reasoning
```
  31  .send(user)
  73  .send(user)
```
grep-baseline conf 0.50
'res.send' is named in the release notes and appears in 7 place(s) in this repo. No check was made that these are real call sites.
not broken server/user/user.test.js :status grep-baseline flagged agent · deepseek-v4-flash-free silent

res.status() and an APIError status field. res.status is explicitly unchanged in v5.
1 matched line · reasoning
```
   3  const httpStatus = require('http-status');
```
grep-baseline conf 0.50
'res.status' is named in the release notes and appears in 18 place(s) in this repo. No check was made that these are real call sites.