apollo-server-express: Add direct dependency on express.

[abernix]

The literal import-ing of express in ApolloServer.ts isn't new but, prior to #3047, it had only been a typing dependency — not an actual runtime dependency — since the TypeScript compiler doesn't emit requires when only types are utilized.

To see this first hand, see the emitted dist/ApolloServer.js in apollo-server-express@2.8.2 compared to the same file in apollo-server-express@2.9.0. (Hard to decipher, but check around like 15 and search for "express" in the second link.)

Now that we actually utilize express.Router to build the composition of middleware in #3047 , it's true that express is no longer just a type dependency, but does warrant being a regular dependency as well!

Since this has never been the case before during the entirety of the v2 line, I'm a bit concerned about introducing it now, but it seems other integrations like apollo-server-koa already have similar requirements going back to its introduction in #1282

apollo-server/packages/apollo-server-koa/package.json

Line 41 in 92ea402

"koa": "2.8.1",

Furthermore, we already have similar direct dependencies on other packages which we use directly, like cors and body-parser:

https://github.com/apollographql/apollo-server/blob/ff3af66a0f3c63bfb056feca82fc7e7b7592b4a5/packages/apollo-server-express/package.json

If this turns out to be problematic, we could consider declaring it only in peerDependencies, but those come with their own share of confusion.

Fixes: #3238

[trevor-scheer]

Just making note that our users are now limited to express>=4.17.1 && express<5 (still alpha). I don't think this is a cause for concern, though.

[abernix]

@trevor-scheer They're not necessarily limited to that range, though an incompatible version would result in a duplicated express dependency if the package manager wasn't able to de-dupe based on compatible versions. That said, the version of express that they use would need to have a compatible Router. I suspect that all versions within v4 should meet that requirement.

The express has had v5 in prerelease (e.g. alpha) for a while now, and I'm hoping that Apollo Server 3.x's transports (which will obsolete this getMiddleware code entirely; see #3184) will be the ultimate solution for compatibility with express >=5.