Release 5.0

[dougwilson]

This is a tracking issue for release 5.0.

5.0.0-beta.1 published on npm

I am trying to give better visibility for upcoming changes and so am trying out making a PR for a release here, pulling from the official next release branch into 4.x. This allows for the current pending changes to be easily visible.

Please keep feature requests in their own issues

I'm also leaving this PR unlocked so people can make comments/etc. and we'll see how it goes :) If you want to make a comment on a particular change, please make the comment in the "Files changed" tab so comments are not lost during a rebase (they will occur frequently has 4.x progresses).

The goal of Express 5 is to be API tweaks & the removal of all code from the Express repository, moving into components in the pillarjs project (https://github.com/pillarjs), providing at least basic support for promise-returning handlers and complete HTTP/2 functionality. Express 5 would become a "view into pillarjs" and would be an arrangement of these components.

List of changes for release:

• Add support for Promises in all handlers promises #2259 (though router@2.0.0-alpha.1)
• Add support for Promises in app.param (though router@2.0.0-beta.2)
• Bring back app.router which is just generally useful for directly calling to the router
  • Make sure 3.x-style app.use(app.router) does not explode
• Fix views to resolve paths async Resolve paths for views asynchronously #2653
• Make query parser option default to 'simple' Consider disabling extended query string parsing by default #3361
• Make bodyParser.urlencoded default to 'simple' (though body-parser@2.0.0-beta.1)
• Make req.host actually return the host req.host should be req.hostname #2179
• Make req.query a getter instead of added by middleware remove/opt-out of qs module #2215
• Make res.render always async callback, to hide sync view engines app.render callbacks twice #2668
• Make res.render use the default engine even when an extension was found Feature request View global option ignore extname #2708
• Make res.sendFile use the "etag" application setting Disable ETag for res.sendFile() #2294
• Make res.status throw on invalid argument type Throw on invalid status codes #4212 Throw on bad argument to res.status() #2795 Throw error if argument to res.status is null or undefined #2797 Throw TypeError if argument passed to res.status is null or undefined #3111 Gracefully handle invalid status codes #3137 Gracefully handle invalid status codes #3143
• Make express.static use the "etag" application setting Disabling etag after express.configure doesn't work #2317
• New path matching syntax Path matching semantics update #2057 Update path regexp functionality #2173 bump v5 router to beta.1 #4321 (though router@2.0.0-beta.1)
• Provide separate locals and options to view engine separate locals from config values #2648
• Remove Express 3.x middleware error stubs remove old deprecation warnings #3217
• Use mime-types instead of mime
• Use path-is-absolute module for absolute path detection utils: use external pathIsAbsolute #2620

List of deprecated things removed:

• Leading : in name for app.param(name, fn)
• app.del
• app.param(fn)
• req.acceptsCharset
• req.acceptsEncoding
• req.acceptsLanguage
• res.json(obj, status)
• res.json(status, obj) Remove res.json(status, obj) signature #2939
• res.jsonp(obj, status)
• res.jsonp(status, obj) Remove res.jsonp(status, obj) signature #2940
• req.param()
• res.redirect(url, status) Remove res.redirect(url, status) signature #2941
• res.send(body, status)
• res.send(status)
• res.send(status, body) Remove res.send(status, body) signature #2942
• res.sendfile
• res.vary() (i.e. no arguments) Remove res.vary() (no arguments) signature #2943

List of things to refactor (still provided by express):

• Better res.cookie and general cookie reading/setting (new keygrip and cookies modules; new req.cookies or such)
• Move prototype properties to own repo Move req / res prototype extension to a separate repo #2432
• Move Router to it's own repo Router As Separate Module #2411

Testing this release

If you want to try out this release, you can install it with the following command:

$ npm install expressjs/express#5.0

Owners/collaborators: please do not merge this PR :)

[jonathanong]

here's some mostly refactor-based changes i'd like to see. AFAIK you've got this covered @dougwilson, but let me know if you need help:

• refactor the router to a separate repository
• refactor the view system to a separate repository. maybe templation, maybe something else more backwards compatible
• finish next versions of cookies and keygrip and use them in Express
• finish refactoring body-parser into the request-body module before including it here
• refactor the router to use path-match or something else between path-to-regexp and the router itself
• refactor proxy-addr. i just emailed npm to ask for the trust package

[dougwilson]

All great stuff @jonathanong :) I added all but the body-parser one up there, because I really want to add that in a 4.x release, but time-dependent :D

[ilanbiala]

How close is this to a prerelease? I just want to know if you think it's stable enough to start playing around with for future projects.

[dougwilson]

So you're always welcome to play around with npm install visionmedia/express#5.0 (and you can add "express": "visionmedia/express#5.0" to your package.json if you really wish). If you are looking for something published to npm, just ask :) No one has really ask for it yet is all. Would you like an alpha or something published to npm? I can do it right after 4.10 (which is due something this week) so it'll include 4.10 stuff.

[DominusKelvin]

Great job @wesleytodd and everyone who worked on this issue.

[wesleytodd]

Hey @karlhorky! Thanks for the thanks and the questions. Would you mind moving them into a new issue and we can edit this to link back there? I just dont want to make it even harder to find things burried at the end of a 10 year old issue. 🤣

EDIT: and I should add, this stuff is the main reason we are on next and not latest. There is a ton to figure out before folks get the new version by default or before we even ask folks to migrate. We want to ensure stability, and we would love folks to help with migration tooling and docs updates first.

[lirantal]

Just dropped by to say this is very cool and thank you all for the hard work ❤️

[karlhorky]

Hey @karlhorky! Thanks for the thanks and the questions. Would you mind moving them into a new issue and we can edit this to link back there? I just dont want to make it even harder to find things burried at the end of a 10 year old issue. 🤣

EDIT: and I should add, this stuff is the main reason we are on next and not latest. There is a ton to figure out before folks get the new version by default or before we even ask folks to migrate. We want to ensure stability, and we would love folks to help with migration tooling and docs updates first.

Sounds good, I created a first issue over here:

• Express v4 -> v5 Migration #5944

[Zertz]

I'd like to congratulate everyone involved in this release for their absolutely incredible perseverance in getting Express 5.0 to the finish line! Huge thanks for all your hard work, I'm really looking forward to upgrading! 🙏

[bertolo1988]

Congratulations for the hardwork 🎉
I followed this thread for years 😅

[spperforce]

Thank you so much for releasing all these amazing stuff @wesleytodd . Do we have any plans to backport recent security patches (path-go-regexp, send etc.) in v4?

[blakeembrey]

@spperforce As 4.x is still maintained, all security work has been done for that release. Is there something missing?

[wobsoriano]

This was so cool to see. Congrats to everyone involved!

[sandersn]

Here are the maintainers listed for the Definitely Typed packages:

@types/express

• @borisyankov
• @CMUH
• @puneetar
• @dfrankland

@types/express-serve-static-core

• @borisyankov
• @micksatana
• @JoseLion
• @dwrss
• @andoshin11

But the express types have only had a few changes since 2021, so I don't know how active its maintainers are.

[wesleytodd]

If any of the folks in this list are interested in helping us refine our strategy for supporting typescript, please take a look at the new issue #5944 to continue the discussion.

[mcnaveen]

LGTM 🫡