Zum Inhalt springen
verdict:

Express 5.0.0

featured

Release Notes

note: die Zusammenfassung und die Release Notes sind auf Englisch

warning: Eingriff nötig

3 Breaking Changes5 Kernpunkte

Express 5.0.0 drops Node.js before v18, changes routing and body-parser defaults, and removes deprecated APIs.

Zusammenfassung · nur aus den Release Notes · claude-haiku-5-5 · prompt v7

breaking changesalle zitiert, jeder mit einer Lösung

breaking[1]: Node.js versions before v18 are no longer supported.

release-notes:13
**Node.js version support**: Dropped support for Node.js versions before v18.

help: Upgrade Node.js to version 18 or newer, then follow the migration guide.

breaking[2]: Sub-expression regex patterns in route paths are no longer supported.

release-notes:14
**Routing changes**: Updated to path-to-regexp@8.x, removing sub-expression regex patterns for security reasons (ReDoS mitigation).

help: Rewrite affected routes without sub-expression regex patterns, following the migration guide.

breaking[3]: Old deprecated API method signatures from Express v3 and v4 are removed.

release-notes:17
**Deprecated API methods removed**: Removed old, deprecated API method signatures from Express v3/v4.

help: Replace calls to removed signatures with their v5 equivalents, as listed in the migration guide.

Kernpunkte

release-notesgithub.com/expressjs/express · 104 Zeilen
  1. # Express v5.0.0
  3. 🎉 **Express v5 is finally here!** 🎉
  5. After years of development, the long-awaited Express v5 has been officially released. This version focuses on simplifying the codebase, improving security, and dropping support for older Node.js versions to enable better performance and maintainability.
  7. For detailed information, please check out the official [Express v5 release blog post](https://expressjs.com/2024/10/15/v5-release.html).
  9. ## Most relevant details
  11. ### Major Changes in v5
  13. - **Node.js version support**: Dropped support for Node.js versions before v18.
  14. - **Routing changes**: Updated to `path-to-regexp@8.x`, removing sub-expression regex patterns for security reasons (ReDoS mitigation).
  15. - **Promise support**: Middleware can now return rejected promises, caught by the router as errors.
  16. - **`body-parser` changes**: Several improvements including the ability to customize `urlencoded` body depth and defaulting `extended` to `false`.
  17. - **Deprecated API methods removed**: Removed old, deprecated API method signatures from Express v3/v4.
  19. For a complete list of breaking changes and API deprecations, see the [migration guide](https://expressjs.com/en/guide/migrating-5.html).
  21. ### Security Updates
  23. This release includes important security fixes, including improvements to prevent ReDoS attacks and mitigation for CVE-2024-45590. Full details can be found in the [security release notes](https://expressjs.com/2024/09/29/security-releases.html).
  25. ### Migration
  27. Be sure to check out our [migration guide](https://expressjs.com/en/guide/migrating-5.html) for instructions on how to update your applications from Express v4 to v5.
  29. ### Security Guidance
  31. For best practices, we recommend reviewing the [Threat Model](https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md) which outlines Express' approach to securing your applications, including tips for user input validation and other critical aspects.
  34. ## What's Changed
  35. * 4.19.2 Staging by @wesleytodd in https://github.com/expressjs/express/pull/5561
  36. * remove duplicate location test for data uri by @wesleytodd in https://github.com/expressjs/express/pull/5562
  37. * feat: document beta releases expectations by @marco-ippolito in https://github.com/expressjs/express/pull/5565
  38. * Cut down on duplicated CI runs by @jonchurch in https://github.com/expressjs/express/pull/5564
  39. * Add a Threat Model by @UlisesGascon in https://github.com/expressjs/express/pull/5526
  40. * Assign captain of encodeurl by @blakeembrey in https://github.com/expressjs/express/pull/5579
  41. * Nominate jonchurch as repo captain for `http-errors`, `expressjs.com`, `morgan`, `cors`, `body-parser` by @jonchurch in https://github.com/expressjs/express/pull/5587
  42. * docs: update Security.md by @inigomarquinez in https://github.com/expressjs/express/pull/5590
  43. * docs: update triage nomination policy by @UlisesGascon in https://github.com/expressjs/express/pull/5600
  44. * Add CodeQL (SAST) by @UlisesGascon in https://github.com/expressjs/express/pull/5433
  45. * docs: add UlisesGascon as triage initiative captain by @UlisesGascon in https://github.com/expressjs/express/pull/5605
  46. * Use object with null prototype for various app properties by @EvanHahn in https://github.com/expressjs/express/pull/4861
  47. * deps: encodeurl@~2.0.0 by @blakeembrey in https://github.com/expressjs/express/pull/5569
  48. * skip QUERY method test by @jonchurch in https://github.com/expressjs/express/pull/5628
  49. * ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in https://github.com/expressjs/express/pull/5639
  50. * add support Node.js@22 in the CI by @mertcanaltin in https://github.com/expressjs/express/pull/5627
  51. * doc: add table of contents, tc/triager lists to readme by @mertcanaltin in https://github.com/expressjs/express/pull/5619
  52. * List and sort all projects, add captains by @blakeembrey in https://github.com/expressjs/express/pull/5653
  53. * Call callback once on listen error by @wesleytodd in https://github.com/expressjs/express/pull/3216
  54. * docs: add @UlisesGascon as captain for cookie-parser by @UlisesGascon in https://github.com/expressjs/express/pull/5666
  55. * ✨ bring back query tests for node 21 by @ctcpip in https://github.com/expressjs/express/pull/5690
  56. * [v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` by @jonchurch in https://github.com/expressjs/express/pull/5672
  57. * skip QUERY tests for Node 21 only, still not supported by @jonchurch in https://github.com/expressjs/express/pull/5695
  58. * 📝 update people, add ctcpip to TC by @ctcpip in https://github.com/expressjs/express/pull/5683
  59. * remove minor version pinning from ci by @jonchurch in https://github.com/expressjs/express/pull/5722
  60. * Fix link variable use in attribution section of CODE OF CONDUCT by @IamLizu in https://github.com/expressjs/express/pull/5762
  61. * Replace Appveyor windows testing with GHA by @jonchurch in https://github.com/expressjs/express/pull/5599
  62. * Add OSSF Scorecard badge by @UlisesGascon in https://github.com/expressjs/express/pull/5436
  63. * Throw on invalid status codes by @jonchurch in https://github.com/expressjs/express/pull/4212
  64. * Use Array.flat instead of array-flatten by @almic in https://github.com/expressjs/express/pull/5677
  65. * Adopt Node@18 as the minimum supported version by @UlisesGascon in https://github.com/expressjs/express/pull/5803
  66. * Ignore `expires` and `maxAge` in `res.clearCookie()` by @jonchurch in https://github.com/expressjs/express/pull/5792
  67. * send@1.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5786
  68. * chore: upgrade `debug` dep from 3.10 to 4.3.6 by @carpasse in https://github.com/expressjs/express/pull/5829
  69. * refactor: replace 'path-is-absolute' dep with node:path isAbsolute method by @carpasse in https://github.com/expressjs/express/pull/5830
  70. * update scorecard link by @bjohansebas in https://github.com/expressjs/express/pull/5814
  71. * Nominate @IamLizu to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/5836
  72. * deps: path-to-regexp@0.1.8 by @blakeembrey in https://github.com/expressjs/express/pull/5603
  73. * docs: specify new instructions for `question` and `discuss` by @IamLizu in https://github.com/expressjs/express/pull/5835
  74. * 5.x: Upgrading `merge-descriptors` with allowing minors by @RobinTail in https://github.com/expressjs/express/pull/5782
  75. * 4.x: Upgrade `merge-descriptors` dependency by @RobinTail in https://github.com/expressjs/express/pull/5781
  76. * WIP: serve-static@2 by @wesleytodd in https://github.com/expressjs/express/pull/5790
  77. * chore: upgrade qs dp from 6.11.0 to 6.13.0 by @carpasse in https://github.com/expressjs/express/pull/5847
  78. * Upgrade cookie signature by @IamLizu in https://github.com/expressjs/express/pull/5833
  79. * accepts@2 by @wesleytodd in https://github.com/expressjs/express/pull/5881
  80. * mime-types@3 by @wesleytodd in https://github.com/expressjs/express/pull/5882
  81. * type-is@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5883
  82. * content-disposition@^1.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5884
  83. * fix(deps): finalhandler@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5899
  84. * path-to-regexp@0.1.10 by @blakeembrey in https://github.com/expressjs/express/pull/5902
  85. * update to `fresh@^2.0.0` by @jonchurch in https://github.com/expressjs/express/pull/5916
  86. * router@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5885
  87. * Adopt Node@18 as the minimum supported version by @UlisesGascon in https://github.com/expressjs/express/pull/5595
  88. * master -> 5.0 by @ctcpip in https://github.com/expressjs/express/pull/5785
  89. * 🔧 update CI, remove unsupported versions, clean up by @ctcpip in https://github.com/expressjs/express/pull/5931
  90. * Delete `back` as a magic string by @blakeembrey in https://github.com/expressjs/express/pull/5933
  91. * Release 5.0 by @dougwilson in https://github.com/expressjs/express/pull/2237
  93. ## New Contributors
  94. * @marco-ippolito made their first contribution in https://github.com/expressjs/express/pull/5565
  95. * @inigomarquinez made their first contribution in https://github.com/expressjs/express/pull/5590
  96. * @mertcanaltin made their first contribution in https://github.com/expressjs/express/pull/5627
  97. * @ctcpip made their first contribution in https://github.com/expressjs/express/pull/5690
  98. * @IamLizu made their first contribution in https://github.com/expressjs/express/pull/5762
  99. * @almic made their first contribution in https://github.com/expressjs/express/pull/5677
  100. * @carpasse made their first contribution in https://github.com/expressjs/express/pull/5829
  101. * @bjohansebas made their first contribution in https://github.com/expressjs/express/pull/5814
  102. * @RobinTail made their first contribution in https://github.com/expressjs/express/pull/5782
  104. **Full Changelog**: https://github.com/expressjs/express/compare/v5.0.0-beta.3...v5.0.0

auf github ansehenimported 2026-09-28 über npm