Zum Inhalt springen
verdict:

Express 5.3.0

notable

Release Notes

note: die Zusammenfassung und die Release Notes sind auf Englisch

pending: Zusammenfassung in der Warteschlange

Erkannt am 2026-10-10 um 02:31 UTC. Zusammenfassungen kommen meist innerhalb weniger Stunden; die vollständigen Release Notes stehen schon hier unten.

release-notesgithub.com/expressjs/express · 164 Zeilen
  1. ## Highlights
  3. ### 🐞 Bug fixes
  5. - Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by [@YuryShkoda](https://github.com/YuryShkoda) in [#4893](https://github.com/expressjs/express/pull/4893)
  8. Fixed the behavior of `res.send()` to prevent conflicts between `Content-Length` and `Transfer-Encoding` HTTP headers in responses. The `Content-Length` header in `res.send()` is now only added when a `Transfer-Encoding` header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a `Transfer-Encoding` header - by [@cuishuang](https://github.com/cuishuang) in [#7459](https://github.com/expressjs/express/pull/7459)
  10. * Upgrade `qs` to `^6.16.0`, which fixes [CVE-2026-2391](https://www.cve.org/CVERecord?id=CVE-2026-2391) ([GHSA-w7fw-mjwx-w883](https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883)), [CVE-2026-82417](https://www.cve.org/CVERecord?id=CVE-2026-82417) ([GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g)) and [CVE-2026-82562](https://www.cve.org/CVERecord?id=CVE-2026-82562) ([GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)): `arrayLimit` bypasses in comma parsing and a denial of service via an attacker-controlled `isBuffer` - by [@davetashner](https://github.com/davetashner) in [#7057](https://github.com/expressjs/express/pull/7057) and [#7478](https://github.com/expressjs/express/pull/7478), and [@cyphercodes](https://github.com/cyphercodes) in [#7305](https://github.com/expressjs/express/pull/7305)
  12. * Upgrade `proxy-addr` to `^2.0.8`, which fixes [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) - by [@lazerg](https://github.com/lazerg) in [#7474](https://github.com/expressjs/express/pull/7474)
  14. ### 🚀 Improvements
  16. * Allow conditional revalidation for QUERY requests. `req.fresh` previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by [@Cherry](https://github.com/Cherry) in [#7366](https://github.com/expressjs/express/pull/7366)
  18. ```js
  19. // QUERY /reports with If-None-Match: "12345"
  20. app.query('/reports', (req, res) => {
  21. res.set('ETag', '"12345"');
  22. res.send(results); // now responds 304 Not Modified
  23. });
  24. ```
  26. * Improve HTML structure in `res.redirect()` responses when HTML format is accepted by adding `<!DOCTYPE html>`, `<title>`, and `<body>` tags for better browser compatibility - by [@Bernice55231](https://github.com/Bernice55231) in [#5167](https://github.com/expressjs/express/pull/5167)
  28. * When calling `app.render` with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by [AkaHarshit](https://github.com/AkaHarshit) in [#6903](https://github.com/expressjs/express/pull/6903)
  30. ```js
  31. app.render('index', null, callback); // now works as expected
  32. ```
  34. * Upgrade `content-type` to `^2.0.0`, bringing a faster parser (~1.5x quicker `Content-Type` parsing/formatting in `res.send()`) along with a behavior change: `res.send()` now keeps any existing parameters when adding the charset and no longer throws on a `Content-Type` that fails to parse. `type-is` is upgraded to `^2.1.0` as part of the same change - by [@blakeembrey](https://github.com/blakeembrey) in [#7234](https://github.com/expressjs/express/pull/7234)
  36. ```js
  37. res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  38. // -> Content-Type: text/plain; foo=bar; charset=utf-8
  39. ```
  41. * The default error handler now logs the full error object instead of only its stack trace, so nested details such as `Error.cause` and library-specific properties (e.g. Sequelize's `parent`/`original`) are no longer swallowed - by [@Nitin-Mohapatra](https://github.com/Nitin-Mohapatra) in [#6464](https://github.com/expressjs/express/pull/6464)
  43. * Upgrade `content-disposition` to `^2.0.1`, which changes the `Content-Disposition` header emitted by `res.download()`, `res.attachment()`, and `res.sendFile()`: file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by [@blakeembrey](https://github.com/blakeembrey) in [#7233](https://github.com/expressjs/express/pull/7233)
  45. ```js
  46. res.attachment('user.html');
  47. // before -> Content-Disposition: attachment; filename="user.html"
  48. // after -> Content-Disposition: attachment; filename=user.html
  49. ```
  51. * Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored - by [@Mayvis](https://github.com/Mayvis) in [#7390](https://github.com/expressjs/express/pull/7390)
  53. ### ⚡ Performance
  55. * Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@bjohansebas](https://github.com/bjohansebas) in [#6991](https://github.com/expressjs/express/pull/6991)
  58. ## What's Changed
  59. * 📝 add note to history by @ctcpip in https://github.com/expressjs/express/pull/6946
  60. * docs: add @rxmarbles to triagers by @rxmarbles in https://github.com/expressjs/express/pull/6953
  61. * docs: use global Security policy by @UlisesGascon in https://github.com/expressjs/express/pull/6570
  62. * doc: fix security.md link to point to security tab by @jonchurch in https://github.com/expressjs/express/pull/6976
  63. * build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/6961
  64. * fix: enhance req.acceptsCharsets method by @Abdel-Monaam-Aouini in https://github.com/expressjs/express/pull/6088
  65. * build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/6965
  66. * build(deps): bump github/codeql-action from 4.31.6 to 4.31.9 by @dependabot[bot] in https://github.com/expressjs/express/pull/6964
  67. * fix(deps): update version lib qs by @gabrieel1007 in https://github.com/expressjs/express/pull/6969
  68. * build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/6963
  69. * build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/6962
  70. * nominate @krzysdz to triage team by @bjohansebas in https://github.com/expressjs/express/pull/6482
  71. * Polish HTML structure of the response in the res.redirect() function by @Bernice55231 in https://github.com/expressjs/express/pull/5167
  72. * docs: fix JSDoc for req.accepts() return value and parameter format by @marcosmol204 in https://github.com/expressjs/express/pull/6936
  73. * test: added unit tests for utils.compileETag to cover valid and invalid inputs by @sukdev24 in https://github.com/expressjs/express/pull/6534
  74. * chore: remove benchmarks directory by @bjohansebas in https://github.com/expressjs/express/pull/6992
  75. * feat: do not modify the Content-Type twice when sending strings by @bjohansebas in https://github.com/expressjs/express/pull/6991
  76. * feat: Allow passing null or undefined as the value for options in app.render by @AkaHarshit in https://github.com/expressjs/express/pull/6903
  77. * test: add test for normalizeType fallback when mime lookup fails by @Ayoub-Mabrouk in https://github.com/expressjs/express/pull/6894
  78. * fix: search example to support Redis v4+ and Express 4/5 by @vinybrun in https://github.com/expressjs/express/pull/6274
  79. * docs: Add @GroophyLifefor to the triage team by @bjohansebas in https://github.com/expressjs/express/pull/6995
  80. * build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in https://github.com/expressjs/express/pull/7011
  81. * build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7012
  82. * build(deps): bump github/codeql-action from 4.31.9 to 4.32.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7013
  83. * Remove duplicate tests in res.location and res.jsonp by @GroophyLifefor in https://github.com/expressjs/express/pull/6996
  84. * fix: bump qs minimum to ^6.14.2 for CVE-2026-2391 by @davetashner in https://github.com/expressjs/express/pull/7057
  85. * docs: fix README security policy by @pavan-sh in https://github.com/expressjs/express/pull/7029
  86. * include edge case tests for `res.type()` by @IshitaSingh0822 in https://github.com/expressjs/express/pull/7037
  87. * build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in https://github.com/expressjs/express/pull/7072
  88. * build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7073
  89. * build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7074
  90. * docs: replace dummy with placeholder in example comments by @samtuckerdavis in https://github.com/expressjs/express/pull/7064
  91. * docs: remove dead link from Readme by @ayushshukla1807 in https://github.com/expressjs/express/pull/7136
  92. * fix: update deprecated npm install docs URL in Readme.md by @Vansh1811 in https://github.com/expressjs/express/pull/7159
  93. * build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/7148
  94. * build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7149
  95. * build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/7150
  96. * fixed typo in history.md by @opensourcezeal in https://github.com/expressjs/express/pull/7191
  97. * chore: ensure safe config in the npmrc by @sheplu in https://github.com/expressjs/express/pull/7144
  98. * ci: build express with node.js v26 by @shivarm in https://github.com/expressjs/express/pull/7218
  99. * build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7210
  100. * build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/7211
  101. * build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in https://github.com/expressjs/express/pull/7212
  102. * fix: bump qs minimum to 6.15.2 by @cyphercodes in https://github.com/expressjs/express/pull/7305
  103. * Upgrade `content-type` by @blakeembrey in https://github.com/expressjs/express/pull/7234
  104. * Improve error logging by logging full error object by @Nitin-Mohapatra in https://github.com/expressjs/express/pull/6464
  105. * fix: replace deprecated trimRight() with trimEnd() by @tejgokani in https://github.com/expressjs/express/pull/7265
  106. * build(deps): bump github/codeql-action from 4.35.2 to 4.36.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7297
  107. * Upgrade `content-disposition` by @blakeembrey in https://github.com/expressjs/express/pull/7233
  108. * fix(res.send): add Content-Length header only if Transfer-Encoding is not present by @YuryShkoda in https://github.com/expressjs/express/pull/4893
  109. * docs: use the new logo by @bjohansebas in https://github.com/expressjs/express/pull/7316
  110. * build(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7345
  111. * build(deps-dev): bump morgan from 1.10.1 to 1.11.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7353
  112. * feat: allow conditional revalidation for QUERY requests by @Cherry in https://github.com/expressjs/express/pull/7366
  113. * build(deps-dev): bump hbs from 4.2.0 to 4.2.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/7152
  114. * deps: bump body-parser to ^2.3.0 to fix CVE-2026-12590 by @Mayvis in https://github.com/expressjs/express/pull/7390
  115. * build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/7403
  116. * docs(res.location): clean up deprecated back string references by @spellsaif in https://github.com/expressjs/express/pull/7406
  117. * build(deps): bump coverallsapp/github-action from 2.3.7 to 2.3.8 by @dependabot[bot] in https://github.com/expressjs/express/pull/7399
  118. * build(deps): bump github/codeql-action/upload-sarif from 4.36.0 to 4.37.3 by @dependabot[bot] in https://github.com/expressjs/express/pull/7400
  119. * chore: group github actions updates by @Phillip9587 in https://github.com/expressjs/express/pull/7460
  120. * build(deps-dev): bump hbs from 4.2.1 to 4.3.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7450
  121. * build(deps): bump the github-actions group with 5 updates by @dependabot[bot] in https://github.com/expressjs/express/pull/7462
  122. * build(deps-dev): bump morgan from 1.11.0 to 1.12.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/7461
  123. * docs: fix capitalization of GitHub Discussions in Readme by @Kimkoungsoo in https://github.com/expressjs/express/pull/7426
  124. * ci: add npm staged publication with dist-tag support by @UlisesGascon in https://github.com/expressjs/express/pull/7464
  125. * fix(res.send): preserve ETag generation with Transfer-Encoding by @cuishuang in https://github.com/expressjs/express/pull/7459
  126. * deps: proxy-addr@^2.0.8 by @lazerg in https://github.com/expressjs/express/pull/7474
  127. * deps: bump qs minimum to 6.16.0 by @davetashner in https://github.com/expressjs/express/pull/7478
  128. * build(deps-dev): bump morgan from 1.12.0 to 1.12.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/7493
  129. * docs: add missing apostrophe in "can\u0027t" (lib + example) by @haimingZZ in https://github.com/expressjs/express/pull/7483
  130. * build(deps-dev): bump hbs from 4.3.0 to 4.3.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/7500
  131. * build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in https://github.com/expressjs/express/pull/7499
  132. * docs: fix pass-through typos by @whoalin1 in https://github.com/expressjs/express/pull/7509
  133. * docs: fix typos and a stale API reference in lib comments by @fmtappendf in https://github.com/expressjs/express/pull/7512
  134. * Release: 5.3.0 by @UlisesGascon in https://github.com/expressjs/express/pull/7468
  136. ## New Contributors
  137. * @rxmarbles made their first contribution in https://github.com/expressjs/express/pull/6953
  138. * @gabrieel1007 made their first contribution in https://github.com/expressjs/express/pull/6969
  139. * @Bernice55231 made their first contribution in https://github.com/expressjs/express/pull/5167
  140. * @marcosmol204 made their first contribution in https://github.com/expressjs/express/pull/6936
  141. * @sukdev24 made their first contribution in https://github.com/expressjs/express/pull/6534
  142. * @AkaHarshit made their first contribution in https://github.com/expressjs/express/pull/6903
  143. * @vinybrun made their first contribution in https://github.com/expressjs/express/pull/6274
  144. * @GroophyLifefor made their first contribution in https://github.com/expressjs/express/pull/6996
  145. * @davetashner made their first contribution in https://github.com/expressjs/express/pull/7057
  146. * @pavan-sh made their first contribution in https://github.com/expressjs/express/pull/7029
  147. * @IshitaSingh0822 made their first contribution in https://github.com/expressjs/express/pull/7037
  148. * @samtuckerdavis made their first contribution in https://github.com/expressjs/express/pull/7064
  149. * @ayushshukla1807 made their first contribution in https://github.com/expressjs/express/pull/7136
  150. * @Vansh1811 made their first contribution in https://github.com/expressjs/express/pull/7159
  151. * @opensourcezeal made their first contribution in https://github.com/expressjs/express/pull/7191
  152. * @cyphercodes made their first contribution in https://github.com/expressjs/express/pull/7305
  153. * @Nitin-Mohapatra made their first contribution in https://github.com/expressjs/express/pull/6464
  154. * @tejgokani made their first contribution in https://github.com/expressjs/express/pull/7265
  155. * @YuryShkoda made their first contribution in https://github.com/expressjs/express/pull/4893
  156. * @Mayvis made their first contribution in https://github.com/expressjs/express/pull/7390
  157. * @spellsaif made their first contribution in https://github.com/expressjs/express/pull/7406
  158. * @Kimkoungsoo made their first contribution in https://github.com/expressjs/express/pull/7426
  159. * @cuishuang made their first contribution in https://github.com/expressjs/express/pull/7459
  160. * @haimingZZ made their first contribution in https://github.com/expressjs/express/pull/7483
  161. * @whoalin1 made their first contribution in https://github.com/expressjs/express/pull/7509
  162. * @fmtappendf made their first contribution in https://github.com/expressjs/express/pull/7512
  164. **Full Changelog**: https://github.com/expressjs/express/compare/v5.2.1...v5.3.0

auf github ansehendetected 2026-10-10 über npm