New features in 3.x

Application

app.head() support
app.locals.use(callback) view-specific parallel middleware to expose dynamic local variables
app.render(name[, options], callback) to render app-level views

trust proxy setting enables the use of "X-Forwarded-Proto" for req.protocol and res.redirect url construction
json spaces setting enables the developer to decide is res.json() responds with nicely formatted JSON or compact json (this value is passed to JSON.stringify())
json replacer setting is a callback which is passed to JSON.stringify() in res.json() allowing you to manipulate and filter the JSON response

req.protocol returns the protocol string "http" or "https" (supports X-Forwarded-Proto via trust proxy setting)
req.get(field) gets a request header field value (req.get('Host'))
req.accepts(type) improved
req.accepted array of parsed Accept values sorted by quality
req.acceptsCharset(charset) added
req.acceptedCharsets array of parsed Accept-Charset values sorted by quality
req.acceptsLanguage(lang) added
req.acceptedLanguages array of parsed Accept-Language values sorted by quality
req.signedCookies object containing signed cookies
req.stale to see if a request is stale (based on ETag/Last-Modified)
req.fresh to compliment req.stale

res.get(field) gets a response header field value (res.get('Content-Length'))
res.set(field, value) sets a response header field (res.set('Content-Length', n))
res.cache(str[, options]) Cache-Control helper
res.signedCookie() set a signed cookie
res.set(field, value) set field value
res.set(obj) set several field values
res.type(path) alias of previous res.contentType(path), allows res.type('json'), res.type('application/x-whatever')
res.redirect() relative support (res.redirect('../new'), res.redirect('./edit'), etc)
res.respondTo(types) to format responses based on qvalue-sorted Accept
JSON cookie support