pkg: Update path-to-regexp to v8

[ntucker]

Motivation

path-to-regexp v6 is vulnerable to ReDoS when routes use two or more parameters between slashes. v8 removes regex features entirely to eliminate this class of vulnerability. The v8 syntax is also the finalized syntax for Express.js v5.

Solution

Upgrade path-to-regexp from v6 to v8 in @data-client/rest, updating runtime code, TypeScript path-inference types, docs, and blog.

Runtime (RestHelpers.ts):

• Updated compile() and parse() calls for the v8 API
• Added recursive tokenMap() to handle v8's structured token tree (including group tokens for {...} optional syntax)

Types (pathTypes.ts):

• PathKeys / PathSplits: Handle *name wildcards alongside :name params, with v8-appropriate delimiter and escape sets
• Added CleanKey type to strip quotes from quoted parameter names (:"with-dash" → with-dash)
• Removed v6 ? suffix handling; optionality now detected via trailing } from {...} groups

Tests:

• New pathTypes.test.ts with 50+ direct type-level assertions covering all v8 patterns
• Migrated all v6 syntax in types.test.ts to v8

Docs & blog:

• Updated RestEndpoint.path examples and escape character docs
• Updated resource.md GitHub search example
• Added path-to-regexp v8 migration section to draft v0.16 blog post with <SkillTabs> for AI-assisted migration
• Added path-to-regexp-v8-migration AI skill for automated path migration

Made with Cursor

---

Note

Medium Risk
This is a breaking change to RestEndpoint.path/Resource.path parsing and URL generation, so incorrect migrations could produce mismatched URLs/keys at runtime. The upgrade is mitigated by updated docs/examples plus new runtime and type-level tests, but it impacts a core REST API surface.

Overview
Upgrades @data-client/rest from path-to-regexp v6→v8 (breaking path syntax change), updating runtime compilation/token parsing (RestHelpers.ts) and pathRegex handling.

Fixes URL generation to omit optional path segments when the corresponding param is undefined, preventing literal "undefined" in generated URLs, and adds regression tests for this behavior.

Updates TypeScript path inference (pathTypes.ts) for v8 features like {} optionals, *name wildcards, quoted parameter names, and new escaping rules, with a new typescript-tests/pathTypes.test.ts suite and broad test/example/doc migrations to the new syntax. Also adjusts docs/blog and SkillTabs usage, and adds a path-to-regexp-v8-migration skill plus changesets for the minor/patch releases.

^{Written by Cursor Bugbot for commit 57e0373. This will update automatically on new commits. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 57e0373

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@data-client/rest	Minor
test-bundlesize	Patch
coinbase-lite	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Size Change: -182 B (-0.23%)

Total Size: 80.4 kB

Filename	Size	Change
examples/test-bundlesize/dist/App.js	3.18 kB	-242 B (-7.08%)	✅
examples/test-bundlesize/dist/rdcEndpoint.js	6.3 kB	+60 B (+0.96%)

ℹ️ View Unchanged

Filename	Size
examples/test-bundlesize/dist/polyfill.js	307 B
examples/test-bundlesize/dist/rdcClient.js	10.2 kB
examples/test-bundlesize/dist/react.js	59.7 kB
examples/test-bundlesize/dist/webpack-runtime.js	726 B

_{compressed-size-action}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.05%. Comparing base (5783267) to head (57e0373).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3757   +/-   ##
=======================================
  Coverage   98.05%   98.05%           
=======================================
  Files         151      151           
  Lines        2821     2831   +10     
  Branches      553      554    +1     
=======================================
+ Hits         2766     2776   +10     
  Misses         11       11           
  Partials       44       44           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.