zwave-js / zwave-js-ui / 22183061276

19%

push

github

fix: remove deprecated csurf and querystring packages (#4554)

## Summary

Fixes #4504

- Remove the archived/unmaintained `csurf` package and its
`@types/csurf` type definitions
- This also removes the transitive `querystring` dependency that caused
npm deprecation warnings
- Remove the `csrfProtection` middleware from `/api/authenticate` and
`/api/password` routes

The CSRF middleware was effectively a no-op — the `value` function
called `req.csrfToken()` (which always generates a valid token), and the
frontend never sent any CSRF token. The app already has strong security
measures: rate limiting, JWT auth, session auth, CORS, and httpOnly
cookies.

## Test plan

- [x] `npm install` completes without csurf/querystring deprecation
warnings
- [x] `npm run build:server` — TypeScript compiles cleanly
- [ ] Login/authentication works correctly with auth enabled
- [ ] Password change endpoint works correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

334 of 444 branches covered (75.23%)

Branch coverage included in aggregate %.

0 of 59 new or added lines in 1 file covered. (0.0%)

4052 of 22298 relevant lines covered (18.17%)

1.13 hits per line