Express 5.0 - last push!

[UlisesGascon]

This issue includes a reference to all the PRs/issues or pending tasks for Express and dependencies needed to finally ship Express@5.

Rules (WIP):

• If something is completed, just marked
• If there is a PR/Issue/Discussion please add it (try to use one item)
• If there is someone taking ownership on it, please add it. Ownership means to be the focal point for it not necessarily the person who makes the final change.
• If there is no leader, feel free to claim it.
• If you can no longer lead something, just let others claim it back
• As this issue can have many comments, feel free to address them and then mark the original comment as "outdated" (details) so it is easier to follow.

If you think that any reference is missing, please edit this comment (@expressjs/express-tc) or reply with a comment if you don't have the permissions.

Pending things (Express):

• add support Node.js@22 in the CI express#5627 (@mertcanaltin)
• Adopt Node@18 as the minimum supported version express#5595 (@UlisesGascon )
• Use object with null prototype for various app properties express#4861
• Ignore expires and maxAge in res.clearCookie() express#5792 (@jonchurch)
• Use object with null prototype for settings express#4835
• Throw on invalid status codes express#4212 (@jonchurch)
• Call callback once on listen error express#3216 (@wesleytodd)
• Update 5.0 version in Migration Guide expressjs.com#1464 (@crandmck)
• express 5 router wildcard does not work as documented expressjs.com#1408 (@blakeembrey )
• Use Array.flat instead of array-flatten express#5677 (@UlisesGascon )
• List of dependencies to upgrade #256 (@UlisesGascon / @IamLizu)

Pending things (Dependencies):

• router@^2.0.0 express#5885 (@wesleytodd)
  • path-to-regexp@^8.0.0 pillarjs/router#117
  • Release 2.0 pillarjs/router#60
• Release 2.0 body-parser#66 (@wesleytodd)
• Added support for brotli ('br') content-encoding body-parser#406 (@wesleytodd or @UlisesGascon or TBD)
• Also use the qs module for the simple parser body-parser#387 (@wesleytodd)
• urlencoded: Support iso-8859-1, utf8 sentinel, and numeric entities body-parser#326 (@wesleytodd)
• Release 1.0 pillarjs/send#208 (@blakeembrey or @wesleytodd its a race)
• Release 2.0 serve-static#165 (@wesleytodd)
• Release: 3.0 jshttp/mime-types#129 (@wesleytodd)
  • mime-types@3 express#5882
  • accepts@2 express#5881
  • type-is@^2.0.0 express#5883
• fix(deps): finalhandler@^2.0.0 express#5899
  • 2.x Staging PR pillarjs/finalhandler#55
  • fix: gracefully handle when handling an error and socket is null pillarjs/finalhandler#57
• Fix: Expect return true immediately if If-None-Match matches the ETag header (#35) jshttp/fresh#38 (@jonchurch)
• Look through the direct deps to see if they have things which need to land,, or releases to cut, untracked WORK! (@wesleytodd)
• Ensure each of the dependencies updates their transitives

Pending things (Documentation):

• Add blog expressjs.com#1483 It will great to do an announcement in the blog about the release and celebrate this big milestone for the project 🥳 (@UlisesGascon )
• Update security and performance best practices expressjs.com#1466 Should be offer a fresh version when v5 is ready? (@UlisesGascon )
• Review and Update v5.x Documentation against v4.x expressjs.com#1479 (@UlisesGascon )

Discussions pending:

New

• Express Generator? Context

Under Investigation

• Cleaner way for redirecting back to the Referrer express#2692 (@blakeembrey )
• Resolve paths for views asynchronously express#2653 (@blakeembrey )

Decisions made:

Not in 5.x

• Support http/2. express#3730
• Moves req/res out of the repo express#3214
• Settings functionality moved out of core express#3218
• Remove direct http dependency express#3213
• separate locals from config values express#2648
• rebase: Generic Body Parser implemented body-parser#524
• response is only finished if socket is detached jshttp/on-finished#31 (@UlisesGascon)

Future Minors

• feat(response): new setting strict status codes express#5856 (@aagamezl)
• New Integration tests (example split continuation) express#5492 (@UlisesGascon )
• Moves compileQueryParser to separate module express#3259 (@wesleytodd)

[wesleytodd]

Awesome! Was this list pulled from those labels? One thing we probably need to add as a TODO is to go through all of the direct dependencies and ensure they all have correctly triaged ones which should land before v5, or did you do that as well? It is hard to tell from the list but I dont see any body parser issues in here and I could have sworn there was some pending work to land in there (and that is likely not the only one if we haven't explicitly checked them all)?

[UlisesGascon]

Awesome! Was this list pulled from those labels?

This was done manually. I quickly reviewed the express and expressjs.com repositories. If anything is missing from dependencies, please feel free to add them. The list may not be exhaustive at this point, but it's a great starting point and compass to help us focus on v5.x. You made a great suggestion with this approach 🙌

Let's also see if the @expressjs/triagers can help us find missing items on the list and assist in reviewing PRs and taking leadership in some of them (I see a few PRs that require conflict resolution, updates...).

[CBID2]

Can I do the "Add the blog one" @UlisesGascon?

[wesleytodd]

Yeah this is great! Absolutely agree with getting folks involved in taking ownership of them. Go team!

If anything is missing from dependencies, please feel free to add them.

Ok yeah this was my main concern. I knew for sure there is router stuff which is why I started there with the labels, but I think there is more in the other few. So if anyone wants to take point on reviewing the deps we own which are "direct deps" of express that would be awesome. Specifically I think each repo needs to address if there are any pending breaking changes which look like they were ready to land (if they are too contentious or too incomplete then we should not land them now) or if there is a pre-existing major version branch with work left to do on it (which is the case in a few for sure). For that we need to catalog that work here so we make sure we don't miss anything.

[jonchurch]

Active dev branch for v5 is 5.x, correct? As opposed to 5.0 which would be a release branch?

[mertcanaltin]

Can I do the "Add the blog one" @UlisesGascon?

I can help you 🚀

[mertcanaltin]

Add support for Node@22 in the CI (no leader), would like to work with this topic

[UlisesGascon]

Can I do the "Add the blog one" @UlisesGascon?

I think that @chrisdel101 is actively working on it, maybe we can provide them more support.

Aside of active development for sure you (@CBID2 @mertcanaltin) can work on:

• Reviewing the PR(s) for the new blog
• Start to work on the blog entries content (see: Ideas for blog content expressjs.com#1500)

Add support for Node@22 in the CI (no leader), would like to work with this topic.

I think that maybe @rxmarbles is working on it, based on slack comment

[wesleytodd]

Active dev branch for v5 is 5.x, correct? As opposed to 5.0 which would be a release branch?

Yeah exactly. That said I have gotten confused a few times and I think this is one case where we would benefit from automation and some really clear and simple docs.