Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: expressjs/express
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 5.0.1
Choose a base ref
...
head repository: expressjs/express
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v5.1.0
Choose a head ref
27 contributors
Loading
Showing with 968 additions and 782 deletions.
  1. +1 −1 .editorconfig
  2. +17 −0 .github/dependabot.yml
  3. +37 −40 .github/workflows/ci.yml
  4. +3 −3 .github/workflows/codeql.yml
  5. +32 −34 .github/workflows/legacy.yml
  6. +72 −0 .github/workflows/scorecard.yml
  7. +3 −3 Charter.md
  8. +1 −1 Collaborator-Guide.md
  9. +73 −37 Contributing.md
  10. +24 −0 History.md
  11. +52 −47 Readme.md
  12. +12 −9 Release-Process.md
  13. +1 −1 Security.md
  14. +2 −0 Triager-Guide.md
  15. +1 −1 examples/auth/index.js
  16. +1 −1 examples/auth/views/head.ejs
  17. +1 −1 examples/downloads/index.js
  18. +1 −1 examples/ejs/index.js
  19. +1 −1 examples/error-pages/index.js
  20. +2 −2 examples/markdown/index.js
  21. +1 −1 examples/mvc/index.js
  22. +2 −2 examples/mvc/lib/boot.js
  23. +2 −1 examples/params/index.js
  24. +1 −1 examples/route-separation/index.js
  25. +1 −1 examples/search/index.js
  26. +1 −1 examples/static-files/index.js
  27. +2 −2 examples/view-constructor/github-view.js
  28. +1 −1 examples/view-locals/index.js
  29. +17 −28 lib/application.js
  30. +1 −1 lib/express.js
  31. +2 −2 lib/request.js
  32. +23 −11 lib/response.js
  33. +34 −16 lib/utils.js
  34. +2 −2 lib/view.js
  35. +36 −37 package.json
  36. +2 −2 test/Route.js
  37. +77 −77 test/Router.js
  38. +3 −3 test/app.engine.js
  39. +1 −1 test/app.head.js
  40. +1 −1 test/app.js
  41. +1 −1 test/app.listen.js
  42. +1 −1 test/app.locals.js
  43. +2 −2 test/app.render.js
  44. +1 −1 test/app.request.js
  45. +1 −3 test/app.route.js
  46. +315 −266 test/app.router.js
  47. +1 −1 test/app.routes.error.js
  48. +1 −1 test/app.use.js
  49. +1 −1 test/config.js
  50. +1 −1 test/exports.js
  51. +5 −17 test/express.json.js
  52. +5 −17 test/express.raw.js
  53. +2 −3 test/express.static.js
  54. +5 −17 test/express.text.js
  55. +5 −17 test/express.urlencoded.js
  56. +1 −1 test/middleware.basic.js
  57. +1 −1 test/req.get.js
  58. +1 −1 test/req.query.js
  59. +1 −1 test/res.append.js
  60. +0 −1 test/res.attachment.js
  61. +1 −2 test/res.cookie.js
  62. +7 −19 test/res.download.js
  63. +1 −1 test/res.format.js
  64. +1 −1 test/res.json.js
  65. +1 −1 test/res.jsonp.js
  66. +18 −0 test/res.links.js
  67. +2 −2 test/res.location.js
  68. +1 −1 test/res.render.js
  69. +15 −3 test/res.send.js
  70. +20 −19 test/res.sendFile.js
  71. +1 −1 test/support/tmpl.js
  72. +1 −2 test/support/utils.js
  73. +1 −2 test/utils.js
2 changes: 1 addition & 1 deletion .editorconfig
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# http://editorconfig.org
# https://editorconfig.org
root = true

[*]
17 changes: 17 additions & 0 deletions .github/dependabot.yml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: monthly

- package-ecosystem: npm
directory: /
schedule:
interval: monthly
time: "23:00"
timezone: Europe/London
open-pull-requests-limit: 10
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
77 changes: 37 additions & 40 deletions .github/workflows/ci.yml
View file
Original file line number Diff line number Diff line change
@@ -14,6 +14,9 @@ on:
paths-ignore:
- '*.md'

permissions:
contents: read

# Cancel in progress workflows
# in the scenario where we already had a run going for that PR/branch/tag but then triggered a new run
concurrency:
@@ -25,15 +28,14 @@ jobs:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js {{ matrix.node-version }}
uses: actions/setup-node@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Setup Node.js
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version: 'lts/*'
persist-credentials: false

- name: Install dependencies
run: npm install --ignore-scripts --only=dev
run: npm install --ignore-scripts --include=dev

- name: Run lint
run: npm run lint
@@ -43,19 +45,19 @@ jobs:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest]
node-version: [18, 19, 20, 21, 22]
node-version: [18, 19, 20, 21, 22, 23]
# Node.js release schedule: https://nodejs.org/en/about/releases/

name: Node.js ${{ matrix.node-version }} - ${{matrix.os}}

runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

- name: Setup Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version: ${{ matrix.node-version }}

@@ -74,44 +76,39 @@ jobs:
- name: Run tests
shell: bash
run: |
npm run test-ci
cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov"
- name: Collect code coverage
run: |
mv ./coverage "./${{ matrix.node-version }}"
mkdir ./coverage
mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}"
run: npm run test-ci

- name: Upload code coverage
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: coverage
path: ./coverage
name: coverage-node-${{ matrix.node-version }}-${{ matrix.os }}
path: ./coverage/lcov.info
retention-days: 1

coverage:
needs: test
runs-on: ubuntu-latest
permissions:
contents: read
checks: write
steps:
- uses: actions/checkout@v4

- name: Install lcov
shell: bash
run: sudo apt-get -y install lcov

- name: Collect coverage reports
uses: actions/download-artifact@v3
with:
name: coverage
path: ./coverage

- name: Merge coverage reports
shell: bash
run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info

- name: Upload coverage report
uses: coverallsapp/github-action@master
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Install lcov
shell: bash
run: sudo apt-get -y install lcov

- name: Collect coverage reports
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
with:
path: ./coverage
pattern: coverage-node-*

- name: Merge coverage reports
shell: bash
run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./lcov.info

- name: Upload coverage report
uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
with:
file: ./lcov.info
6 changes: 3 additions & 3 deletions .github/workflows/codeql.yml
View file
Original file line number Diff line number Diff line change
@@ -34,11 +34,11 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
with:
languages: javascript
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
# ./location_of_script_within_repo/buildscript.sh

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
with:
category: "/language:javascript"
66 changes: 32 additions & 34 deletions .github/workflows/legacy.yml
View file
Original file line number Diff line number Diff line change
@@ -14,6 +14,9 @@ on:
paths-ignore:
- '*.md'

permissions:
contents: read

# Cancel in progress workflows
# in the scenario where we already had a run going for that PR/branch/tag but then triggered a new run
concurrency:
@@ -33,12 +36,12 @@ jobs:

runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

- name: Setup Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version: ${{ matrix.node-version }}

@@ -57,44 +60,39 @@ jobs:
- name: Run tests
shell: bash
run: |
npm run test-ci
cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov"
- name: Collect code coverage
run: |
mv ./coverage "./${{ matrix.node-version }}"
mkdir ./coverage
mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}"
run: npm run test-ci

- name: Upload code coverage
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: coverage
path: ./coverage
name: coverage-node-${{ matrix.node-version }}-${{ matrix.os }}
path: ./coverage/lcov.info
retention-days: 1

coverage:
needs: test
runs-on: ubuntu-latest
permissions:
contents: read
checks: write
steps:
- uses: actions/checkout@v4

- name: Install lcov
shell: bash
run: sudo apt-get -y install lcov

- name: Collect coverage reports
uses: actions/download-artifact@v3
with:
name: coverage
path: ./coverage

- name: Merge coverage reports
shell: bash
run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info

- name: Upload coverage report
uses: coverallsapp/github-action@master
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Install lcov
shell: bash
run: sudo apt-get -y install lcov

- name: Collect coverage reports
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
with:
path: ./coverage
pattern: coverage-node-*

- name: Merge coverage reports
shell: bash
run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./lcov.info

- name: Upload coverage report
uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
with:
file: ./lcov.info
72 changes: 72 additions & 0 deletions .github/workflows/scorecard.yml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
# This workflow uses actions that are not certified by GitHub. They are provided
# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Scorecard supply-chain security
on:
# For Branch-Protection check. Only the default branch is supported. See
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
branch_protection_rule:
# To guarantee Maintained check is occasionally updated. See
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
schedule:
- cron: '16 21 * * 1'
push:
branches: [ "master" ]

# Declare default permissions as read only.
permissions: read-all

jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-latest
permissions:
# Needed to upload the results to code-scanning dashboard.
security-events: write
# Needed to publish results and get a badge (see publish_results below).
id-token: write
# Uncomment the permissions below if installing in a private repository.
# contents: read
# actions: read

steps:
- name: "Checkout code"
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

- name: "Run analysis"
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
with:
results_file: results.sarif
results_format: sarif
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
# - you want to enable the Branch-Protection check on a *public* repository, or
# - you are installing Scorecard on a *private* repository
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
# repo_token: ${{ secrets.SCORECARD_TOKEN }}

# Public repositories:
# - Publish results to OpenSSF REST API for easy access by consumers
# - Allows the repository to include the Scorecard badge.
# - See https://github.com/ossf/scorecard-action#publishing-results.
# For private repositories:
# - `publish_results` will always be set to `false`, regardless
# of the value entered here.
publish_results: true

# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: SARIF file
path: results.sarif
retention-days: 5

# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
with:
sarif_file: results.sarif
6 changes: 3 additions & 3 deletions Charter.md
View file
Original file line number Diff line number Diff line change
@@ -20,11 +20,11 @@ alike.

Express is made of many modules spread between three GitHub Orgs:

- [expressjs](http://github.com/expressjs/): Top level middleware and
- [expressjs](https://github.com/expressjs/): Top level middleware and
libraries
- [pillarjs](http://github.com/pillarjs/): Components which make up
- [pillarjs](https://github.com/pillarjs/): Components which make up
Express but can also be used for other web frameworks
- [jshttp](http://github.com/jshttp/): Low level HTTP libraries
- [jshttp](https://github.com/jshttp/): Low level HTTP libraries

### 1.2: Out-of-Scope

2 changes: 1 addition & 1 deletion Collaborator-Guide.md
View file
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@ Open issues for the expressjs.com website in https://github.com/expressjs/expres
## PRs and Code contributions

* Tests must pass.
* Follow the [JavaScript Standard Style](http://standardjs.com/) and `npm run lint`.
* Follow the [JavaScript Standard Style](https://standardjs.com/) and `npm run lint`.
* If you fix a bug, add a test.

## Branches
Loading