Express 5.0 - last push!

[UlisesGascon]

This issue includes a reference to all the PRs/issues or pending tasks for Express and dependencies needed to finally ship Express@5.

Rules (WIP):

• If something is completed, just marked
• If there is a PR/Issue/Discussion please add it (try to use one item)
• If there is someone taking ownership on it, please add it. Ownership means to be the focal point for it not necessarily the person who makes the final change.
• If there is no leader, feel free to claim it.
• If you can no longer lead something, just let others claim it back
• As this issue can have many comments, feel free to address them and then mark the original comment as "outdated" (details) so it is easier to follow.

If you think that any reference is missing, please edit this comment (@expressjs/express-tc) or reply with a comment if you don't have the permissions.

Pending things (Express):

• [x] Add support for Node@22 in the CI (@mertcanaltin)
• [ ] https://github.com/expressjs/express/pull/5595 (@UlisesGascon )
• [x] https://github.com/expressjs/express/pull/4861
• [ ] https://github.com/expressjs/express/pull/5792 (@jonchurch) supersedes the above PR
• [x] https://github.com/expressjs/express/pull/4835
• [x] https://github.com/expressjs/express/pull/4212 (@jonchurch)
• [x] https://github.com/expressjs/express/pull/3216 (@wesleytodd)
• [ ] https://github.com/expressjs/expressjs.com/issues/1464 (@crandmck)
• [ ] https://github.com/expressjs/expressjs.com/issues/1408 (@blakeembrey )
• [ ] https://github.com/expressjs/express/pull/5677 (@ulisesgascon )
• [ ] Let's upgrade dependencies (@ulisesgascon)

Pending things (Dependencies):

• [ ] https://github.com/pillarjs/router/pull/60 (@blakeembrey)
• [ ] https://github.com/expressjs/body-parser/pull/66 (@wesleytodd)
• [ ] https://github.com/expressjs/body-parser/pull/406 (@wesleytodd or @UlisesGascon or TBD)
• [x] https://github.com/expressjs/body-parser/pull/387 (@wesleytodd)
• [x] https://github.com/expressjs/body-parser/pull/326 (@wesleytodd)
• [x] https://github.com/pillarjs/send/pull/208 (~@blakeembrey or~ @wesleytodd ~its a race~)
• [ ] https://github.com/expressjs/serve-static/pull/165 (@wesleytodd)
• [ ] https://github.com/jshttp/mime-types/pull/126 (@wesleytodd)
  • [ ] https://github.com/jshttp/accepts needs to update mime-types
  • [ ] https://github.com/jshttp/type-is/blob/master/package.json#L13C11-L13C19
• [ ] https://github.com/jshttp/fresh/pull/38
• [ ] https://github.com/jshttp/on-finished/pull/31
• [x] Look through the direct deps to see if they have things which need to land,, or releases to cut, untracked WORK! (@wesleytodd)
• [ ] Ensure each of the dependencies updates their transitives

Pending things (Documentation):

• [ ] https://github.com/expressjs/expressjs.com/issues/1483 It will great to do an announcement in the blog about the release and celebrate this big milestone for the project :partying_face: (@UlisesGascon )
• [ ] https://github.com/expressjs/expressjs.com/issues/1466 Should be offer a fresh version when v5 is ready? (@UlisesGascon )
• [ ] https://github.com/expressjs/expressjs.com/issues/1479 (@UlisesGascon )

Discussions pending:

New

• [ ] Express Generator? Context

Under Investigation

• [ ] https://github.com/expressjs/express/pull/2692 (@blakeembrey )
• [ ] https://github.com/expressjs/express/pull/2653 (@blakeembrey )

Decisions made:

Not in 5.x

• [ ] https://github.com/expressjs/express/pull/3730
• [ ] https://github.com/expressjs/express/pull/3214
• [ ] https://github.com/expressjs/express/pull/3218
• [ ] https://github.com/expressjs/express/pull/3213
• [ ] https://github.com/expressjs/express/pull/2648
• [ ] https://github.com/expressjs/body-parser/pull/524

Future Minors

• [ ] https://github.com/expressjs/express/pull/5492 (@UlisesGascon )
• [ ] https://github.com/expressjs/express/pull/3259 (@wesleytodd)

[wesleytodd]

Awesome! Was this list pulled from those labels? One thing we probably need to add as a TODO is to go through all of the direct dependencies and ensure they all have correctly triaged ones which should land before v5, or did you do that as well? It is hard to tell from the list but I dont see any body parser issues in here and I could have sworn there was some pending work to land in there (and that is likely not the only one if we haven't explicitly checked them all)?

[UlisesGascon]

Awesome! Was this list pulled from those labels?

This was done manually. I quickly reviewed the express and expressjs.com repositories. If anything is missing from dependencies, please feel free to add them. The list may not be exhaustive at this point, but it's a great starting point and compass to help us focus on v5.x. You made a great suggestion with this approach :raised_hands:

Let's also see if the @expressjs/triagers can help us find missing items on the list and assist in reviewing PRs and taking leadership in some of them (I see a few PRs that require conflict resolution, updates...).

[CBID2]

Can I do the "Add the blog one" @UlisesGascon?

[wesleytodd]

Yeah this is great! Absolutely agree with getting folks involved in taking ownership of them. Go team!

If anything is missing from dependencies, please feel free to add them.

Ok yeah this was my main concern. I knew for sure there is router stuff which is why I started there with the labels, but I think there is more in the other few. So if anyone wants to take point on reviewing the deps we own which are "direct deps" of express that would be awesome. Specifically I think each repo needs to address if there are any pending breaking changes which look like they were ready to land (if they are too contentious or too incomplete then we should not land them now) or if there is a pre-existing major version branch with work left to do on it (which is the case in a few for sure). For that we need to catalog that work here so we make sure we don't miss anything.

[jonchurch]

Active dev branch for v5 is 5.x, correct? As opposed to 5.0 which would be a release branch?

[mertcanaltin]

Can I do the "Add the blog one" @UlisesGascon?

I can help you 🚀

[mertcanaltin]

Add support for Node@22 in the CI (no leader), would like to work with this topic

[UlisesGascon]

Can I do the "Add the blog one" @UlisesGascon?

I think that @chrisdel101 is actively working on it, maybe we can provide them more support.

Aside of active development for sure you (@CBID2 @mertcanaltin) can work on:

• Reviewing the PR(s) for the new blog
• Start to work on the blog entries content (see: https://github.com/expressjs/expressjs.com/issues/1500)

Add support for Node@22 in the CI (no leader), would like to work with this topic.

I think that maybe @rxmarbles is working on it, based on slack comment

[wesleytodd]

Active dev branch for v5 is 5.x, correct? As opposed to 5.0 which would be a release branch?

Yeah exactly. That said I have gotten confused a few times and I think this is one case where we would benefit from automation and some really clear and simple docs.

[Yaminyam]

I'm very excited about the new version of express being released! https://github.com/expressjs/generator I think it would be better if this repo was also maintained. I think that the current code written using syntax prior to ES2015 is very outdated. (ref: https://github.com/expressjs/generator/pull/200)

[wesleytodd]

Hey @Yaminyam, that package is on our radar but we need to do the necessary here first. I believe there is a tracking issue for it here: https://github.com/expressjs/discussions/issues/197

[wesleytodd]

@jonchurch do you think this needs to be added to the list above? https://github.com/expressjs/express/issues/4851

EDIT: just to keep the records, this one is related as well I think https://github.com/expressjs/express/pull/4852

[wesleytodd]

I reviewed the remaining open things in body-parser. I added them to the list here, but likely will want to update the linked v2 PR as well. I dont have enough remaining battery on this plane to be able to start work on them, and also I think some are a bit ambigious as to what we need to do to get it across the finish line. Would love if folks could click through some of the ones I added and add any insight or thoughts they have on them and if we need to land them.

[jdhiro]

Why are there so many "bonus" dependencies on the 5.0 release the community has been waiting on for YEARS? (Brotli support?!)

5.0 literally needs two things:

• Async error handling.
• Official Typescript typings.

That's it. Add those and ship it -- for the love of God.

[RobinTail]

@wesleytodd , would it be possible to detach features from the breaking changes needed for those features in order to speed up the release of 5.0?

The brotli support could be a feature of 5.1, isn't it? While dropping Node versions below 18 must be prioritised to enable and ease implementing new features of 5.x.

It's been 10 years.

[ctcpip]

A number of things have been punted from the initial 5.0 release, and more may yet be punted, where possible.

[wesleytodd]

Ok, I just checked off an important one: "Look through the direct deps to see if they have things which need to land"

I have gone through and commented on or resolved as many of the PR's/issues/discussions in the direct and transitives which seem to have some pending (breaking) changes to land. I added a few things on the list, but they are relatively small and should be simple enough to resolve.

Which means, this is pretty much a complete final picture finally of what needs to be wrapped up to release.

[IamLizu]

Here's the list of dependencies needing upgrade,

• [ ] cookie-signature - used 1.0.6 - current 1.2.1
• [ ] debug - used 3.1.0 - current 4.3.6
• [ ] merge-descriptors - used 1.0.1 - current 2.0.0 (may be fixed by https://github.com/expressjs/express/pull/5782)
• [ ] qs - used 6.11.0 - current 6.13.0

Since the issue list with tracking each of these deps are now linked in the main comment, I am hiding this one.

[kibertoad]

@IamLizu How about replacing qs with neoqs? https://github.com/puruvj/neoqs

[wesleytodd]

Hey @kibertoad, can we keep the discussion on that issue in the PR already created? These are just updates of existing deps. I hit the comments as "off topic".

[RobinTail]

Thank you @wesleytodd , @UlisesGascon , @ctcpip and others! This is an epic achievement on the planetary scale. ❤️

[wesleytodd]

We put a closes line in the commit, but looks like it didnt actually close this. So I can happily say this is closed as completed!

[UlisesGascon]

I will relocate the pending things to 2 new issues (backlog for 5.x and Backlog for 6.0) :)

[ctcpip]

resolved via https://github.com/expressjs/express/pull/2237