Express 5.0 - last push!

[UlisesGascon]

This issue includes a reference to all the PRs/issues or pending tasks for Express and dependencies needed to finally ship Express@5.

Rules (WIP):

• If something is completed, just marked
• If there is a PR/Issue/Discussion please add it (try to use one item)
• If there is someone taking ownership on it, please add it. Ownership means to be the focal point for it not necessarily the person who makes the final change.
• If there is no leader, feel free to claim it.
• If you can no longer lead something, just let others claim it back
• As this issue can have many comments, feel free to address them and then mark the original comment as "outdated" (details) so it is easier to follow.

If you think that any reference is missing, please edit this comment (@expressjs/express-tc) or reply with a comment if you don't have the permissions.

Pending things (Express):

• add support Node.js@22 in the CI express#5627 (@mertcanaltin)
• Adopt Node@18 as the minimum supported version express#5595 (@UlisesGascon )
• Use object with null prototype for various app properties express#4861
• Ignore expires and maxAge in res.clearCookie() express#5792 (@jonchurch)
• Use object with null prototype for settings express#4835
• Throw on invalid status codes express#4212 (@jonchurch)
• Call callback once on listen error express#3216 (@wesleytodd)
• Update 5.0 version in Migration Guide expressjs.com#1464 (@crandmck)
• express 5 router wildcard does not work as documented expressjs.com#1408 (@blakeembrey )
• Use Array.flat instead of array-flatten express#5677 (@UlisesGascon )
• List of dependencies to upgrade #256 (@UlisesGascon / @IamLizu)

Pending things (Dependencies):

• router@^2.0.0 express#5885 (@wesleytodd)
  • path-to-regexp@^8.0.0 pillarjs/router#117
  • Release 2.0 pillarjs/router#60
• Release 2.0 body-parser#66 (@wesleytodd)
• Added support for brotli ('br') content-encoding body-parser#406 (@wesleytodd or @UlisesGascon or TBD)
• Also use the qs module for the simple parser body-parser#387 (@wesleytodd)
• urlencoded: Support iso-8859-1, utf8 sentinel, and numeric entities body-parser#326 (@wesleytodd)
• Release 1.0 pillarjs/send#208 (@blakeembrey or @wesleytodd its a race)
• Release 2.0 serve-static#165 (@wesleytodd)
• Release: 3.0 jshttp/mime-types#129 (@wesleytodd)
  • mime-types@3 express#5882
  • accepts@2 express#5881
  • type-is@^2.0.0 express#5883
• fix(deps): finalhandler@^2.0.0 express#5899
  • 2.x Staging PR pillarjs/finalhandler#55
  • fix: gracefully handle when handling an error and socket is null pillarjs/finalhandler#57
• Fix: Expect return true immediately if If-None-Match matches the ETag header (#35) jshttp/fresh#38 (@jonchurch)
• Look through the direct deps to see if they have things which need to land,, or releases to cut, untracked WORK! (@wesleytodd)
• Ensure each of the dependencies updates their transitives

Pending things (Documentation):

• Add blog expressjs.com#1483 It will great to do an announcement in the blog about the release and celebrate this big milestone for the project 🥳 (@UlisesGascon )
• Update security and performance best practices expressjs.com#1466 Should be offer a fresh version when v5 is ready? (@UlisesGascon )
• Review and Update v5.x Documentation against v4.x expressjs.com#1479 (@UlisesGascon )

Discussions pending:

New

• Express Generator? Context

Under Investigation

• Cleaner way for redirecting back to the Referrer express#2692 (@blakeembrey )
• Resolve paths for views asynchronously express#2653 (@blakeembrey )

Decisions made:

Not in 5.x

• Support http/2. express#3730
• Moves req/res out of the repo express#3214
• Settings functionality moved out of core express#3218
• Remove direct http dependency express#3213
• separate locals from config values express#2648
• rebase: Generic Body Parser implemented body-parser#524
• response is only finished if socket is detached jshttp/on-finished#31 (@UlisesGascon)

Future Minors

• feat(response): new setting strict status codes express#5856 (@aagamezl)
• New Integration tests (example split continuation) express#5492 (@UlisesGascon )
• Moves compileQueryParser to separate module express#3259 (@wesleytodd)

[wesleytodd]

Yeah this is great! Absolutely agree with getting folks involved in taking ownership of them. Go team!

If anything is missing from dependencies, please feel free to add them.

Ok yeah this was my main concern. I knew for sure there is router stuff which is why I started there with the labels, but I think there is more in the other few. So if anyone wants to take point on reviewing the deps we own which are "direct deps" of express that would be awesome. Specifically I think each repo needs to address if there are any pending breaking changes which look like they were ready to land (if they are too contentious or too incomplete then we should not land them now) or if there is a pre-existing major version branch with work left to do on it (which is the case in a few for sure). For that we need to catalog that work here so we make sure we don't miss anything.

[UlisesGascon]

Can I do the "Add the blog one" @UlisesGascon?

I think that @chrisdel101 is actively working on it, maybe we can provide them more support.

Aside of active development for sure you (@CBID2 @mertcanaltin) can work on:

• Reviewing the PR(s) for the new blog
• Start to work on the blog entries content (see: Ideas for blog content expressjs.com#1500)

Add support for Node@22 in the CI (no leader), would like to work with this topic.

I think that maybe @rxmarbles is working on it, based on slack comment

[wesleytodd]

Active dev branch for v5 is 5.x, correct? As opposed to 5.0 which would be a release branch?

Yeah exactly. That said I have gotten confused a few times and I think this is one case where we would benefit from automation and some really clear and simple docs.

[wesleytodd]

@jonchurch do you think this needs to be added to the list above? expressjs/express#4851

EDIT: just to keep the records, this one is related as well I think expressjs/express#4852

[wesleytodd]

I reviewed the remaining open things in body-parser. I added them to the list here, but likely will want to update the linked v2 PR as well. I dont have enough remaining battery on this plane to be able to start work on them, and also I think some are a bit ambigious as to what we need to do to get it across the finish line. Would love if folks could click through some of the ones I added and add any insight or thoughts they have on them and if we need to land them.

[RobinTail]

@wesleytodd , would it be possible to detach features from the breaking changes needed for those features in order to speed up the release of 5.0?

The brotli support could be a feature of 5.1, isn't it? While dropping Node versions below 18 must be prioritised to enable and ease implementing new features of 5.x.

It's been 10 years.

[ctcpip]

A number of things have been punted from the initial 5.0 release, and more may yet be punted, where possible.

[wesleytodd]

Ok, I just checked off an important one: "Look through the direct deps to see if they have things which need to land"

I have gone through and commented on or resolved as many of the PR's/issues/discussions in the direct and transitives which seem to have some pending (breaking) changes to land. I added a few things on the list, but they are relatively small and should be simple enough to resolve.

Which means, this is pretty much a complete final picture finally of what needs to be wrapped up to release.

[RobinTail]

Thank you @wesleytodd , @UlisesGascon , @ctcpip and others!
This is an epic achievement on the planetary scale.
❤️

[wesleytodd]

We put a closes line in the commit, but looks like it didnt actually close this. So I can happily say this is closed as completed!

[UlisesGascon]

I will relocate the pending things to 2 new issues (backlog for 5.x and Backlog for 6.0) :)

[ctcpip]

resolved via expressjs/express#2237