Highlights 🐞 Bug fixes Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893 Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specificati…
What's Changed Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by @baryman in #7135 feat: allow conditional revalidation for QUERY requests (v4) by @Cherry in #7377 deps: qs@~6.16.0 by @lazerg in #7440 ci: add npm staged publication with dist-tag support by @UlisesGascon in #7465 4.22.3 by @UlisesGascon in #7466 New Contributors @baryman made their first contribution in #7135 @lazerg made the…
What's Changed fix: restore >20 array parsing for req.query repeated keys (8d09bfe6) This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items. deps: qs@~6.15.1 deps: body-parser@~1.20.5 New Contributors @suuuuuuminnnnnn made their first con…
What's Changed ImportantThe prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release. Release: 4.22.1 by @UlisesGascon in #6934 Full Changelog: 4.22.0...v4.22.1
What's Changed ImportantThe prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release. Release: 5.2.1 by @UlisesGascon in #6933 Full Changelog: v5.2.0...v5.2.1
Important: Security Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6) What's Changed build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by @dependabot[bot] in #6429 Refactor: simplify acceptsLanguages implementation using spread operator by @Ayoub-Mabrouk in #6137 increased code coverage of utils.js file by @ashish3011 in #6386 chore: remove duplicate word by @dufucun in #6456 buil…
Important: Security Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6) What's Changed Refactor: improve readability by @sazk07 in #6190 ci: add support for Node.js@23.0 by @UlisesGascon in #6080 Method functions with no path should error by @wesleytodd in #5957 ci: updated github actions ci workflow by @Phillip9587 in #6323 ci: reorder npm i steps to fix ci for older node versions by @Phillip95…
What's Changed remove --bail from test script by @jonchurch in #5962 Nominate @bjohansebas to the triage team by @UlisesGascon in #6009 Link and update captains by @blakeembrey in #6013 Update cookie semver lock to address CVE-2024-47764 by @joshbuker in #6017 Release: 5.0.1 by @UlisesGascon in #6032 Full Changelog: v5.0.0...5.0.1
What's Changed Update captains by @UlisesGascon in #6027 build: Node.js 23.0 by @bjohansebas in #6075 Add funding field (v5) by @bjohansebas in #6064 ✅ add discarded middleware test by @ctcpip in #5819 update homepage link http to https by @bjohansebas in #5920 Improve readme by @bjohansebas in #5994 Add bjohansebas as repo captain for expressjs.com by @crandmck in #6058 Remove Object.setPrototype…
What's Changed Add funding field (v4) by @bjohansebas in #6065 deps: path-to-regexp@0.1.11 by @blakeembrey in #5956 deps: bump path-to-regexp@0.1.12 by @jonchurch in #6209 Release: 4.21.2 by @UlisesGascon in #6094 Full Changelog: 4.21.1...4.21.2
What's Changed Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in #6029 Release: 4.21.1 by @UlisesGascon in #6031 Full Changelog: 4.21.0...4.21.1
What's Changed Deprecate "back" magic string in redirects by @blakeembrey in #5935 finalhandler@1.3.1 by @wesleytodd in #5954 fix(deps): serve-static@1.16.2 by @wesleytodd in #5951 Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in #5946 New Contributors @agadzinski93 made their first contribution in #5946 Full Changelog: 4.20.0...4.21.0