Hackathon Starter currently depends on express-flash, which itself depends on connect-flash. Both libraries are unmaintained (last updated around 12 years ago). connect-flash has known bugs, and we’ve been patching it with patch-package for months. Continuing to rely on these packages introduces technical debt and fragility. We want to replace them with a custom inline middleware in app.js that provides the same flash messaging functionality without external dependencies.

Scope:

• Remove express-flash from package.json
• Remove connect-flash from the patches directory
• Add a small custom middleware directly in app.js (after express-session) to perform the same function
• Verify Pug templates (layout.pug) continue to render flash messages.
• Tests
• Update README.md

Test cases:

Core Behavior

1. Set a single flash message: calling req.flash('info', 'hello') stores the message in session.
2. Set multiple flash messages: multiple calls before the next request should accumulate messages.
3. Set multiple messages in one call: req.flash('warning', ['msg1', 'msg2']) stores both.
4. Support multiple types: messages of different types (error, info, success) are stored separately.
5. Retrieve and clear messages: reading messages removes them from the session.
6. Retrieve all messages: calling req.flash() with no args returns all messages grouped by type.
7. Return empty array for unknown type: req.flash('unknown') should return [].

Integration Behavior

8. Consume after read: once displayed, messages should not persist into subsequent requests.
9. Expose to views: res.locals.flash should contain messages for rendering in Pug.
10. No messages by default: if nothing is set, res.locals.flash should be empty.
11. Session isolation: messages from one session should not leak into another.

Acceptance Criteria:

• Flash messages continue to render correctly in the UI with Bootstrap alerts.
• No related patch-package hacks remain.
• All above test cases are implemented using Mocha + Chai + Sinonjs (consistent with Hackathon Starter’s test stack).
• CI passes without reliance on express-flash or connect-flash.
• Readme.md is updated and has no reference to express-flash or connect-flash