1# Unreleased Changes23## 🐞 Bug fixes45- Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by [@YuryShkoda](https://github.com/YuryShkoda) in [#4893](https://github.com/expressjs/express/pull/4893)678 Fixed the behavior of `res.send()` to prevent conflicts between `Content-Length` and `Transfer-Encoding` HTTP headers in responses. The `Content-Length` header in `res.send()` is now only added when a `Transfer-Encoding` header is not present, complying with the HTTP specification that states both headers should not coexist in the same response910## 🚀 Improvements1112* Allow conditional revalidation for QUERY requests. `req.fresh` previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by [@Cherry](https://github.com/Cherry) in [#7366](https://github.com/expressjs/express/pull/7366)1314 ```js15 // QUERY /reports with If-None-Match: "12345"16 app.query('/reports', (req, res) => {17 res.set('ETag', '"12345"');18 res.send(results); // now responds 304 Not Modified19 });20 ```2122* Improve HTML structure in `res.redirect()` responses when HTML format is accepted by adding `<!DOCTYPE html>`, `<title>`, and `<body>` tags for better browser compatibility - by [@Bernice55231](https://github.com/Bernice55231) in [#5167](https://github.com/expressjs/express/pull/5167)2324* When calling `app.render` with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by [AkaHarshit](https://github.com/AkaHarshit) in [#6903](https://github.com/expressjs/express/pull/6903)2526 ```js27 app.render('index', null, callback); // now works as expected28 ```2930* Upgrade `content-type` to `^2.0.0`, bringing a faster parser (~1.5x quicker `Content-Type` parsing/formatting in `res.send()`) along with a behavior change: `res.send()` now keeps any existing parameters when adding the charset and no longer throws on a `Content-Type` that fails to parse - by [@blakeembrey](https://github.com/blakeembrey) in [#7234](https://github.com/expressjs/express/pull/7234)3132 ```js33 res.set('Content-Type', 'text/plain; foo=bar').send('hey');34 // -> Content-Type: text/plain; foo=bar; charset=utf-835 ```3637* The default error handler now logs the full error object instead of only its stack trace, so nested details such as `Error.cause` and library-specific properties (e.g. Sequelize's `parent`/`original`) are no longer swallowed - by [@Nitin-Mohapatra](https://github.com/Nitin-Mohapatra) in [#6464](https://github.com/expressjs/express/pull/6464)3839* Upgrade `content-disposition` to `^2.0.0`, which changes the `Content-Disposition` header emitted by `res.download()`, `res.attachment()`, and `res.sendFile()`: file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by [@blakeembrey](https://github.com/blakeembrey) in [#7233](https://github.com/expressjs/express/pull/7233)4041 ```js42 res.attachment('user.html');43 // before -> Content-Disposition: attachment; filename="user.html"44 // after -> Content-Disposition: attachment; filename=user.html45 ```4647* Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored4849## ⚡ Performance5051* Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@bjohansebas](https://github.com/bjohansebas) in [#6991](https://github.com/expressjs/express/pull/6991)52535.2.1 / 2025-12-0154=======================5556* Revert security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))57 * The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.58595.2.0 / 2025-12-0160========================6162* Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))63* deps: `body-parser@^2.2.1`64* A deprecation warning was added when using `res.redirect` with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.65665.1.0 / 2025-03-3167========================6869* Add support for `Uint8Array` in `res.send()`70* Add support for ETag option in `res.sendFile()`71* Add support for multiple links with the same rel in `res.links()`72* Add funding field to package.json73* perf: use loop for acceptParams74* refactor: prefix built-in node module imports75* deps: remove `setprototypeof`76* deps: remove `safe-buffer`77* deps: remove `utils-merge`78* deps: remove `methods`79* deps: remove `depd`80* deps: `debug@^4.4.0`81* deps: `body-parser@^2.2.0`82* deps: `router@^2.2.0`83* deps: `content-type@^1.0.5`84* deps: `finalhandler@^2.1.0`85* deps: `qs@^6.14.0`86* deps: `server-static@2.2.0`87* deps: `type-is@2.0.1`88895.0.1 / 2024-10-0890==========9192* Update `cookie` semver lock to address [CVE-2024-47764](https://nvd.nist.gov/vuln/detail/CVE-2024-47764)93945.0.0 / 2024-09-1095=========================96* remove:97 - `path-is-absolute` dependency - use `path.isAbsolute` instead98* breaking:99 * `res.status()` accepts only integers, and input must be greater than 99 and less than 1000100 * will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range101 * will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs102 * deps: send@1.0.0103 * `res.redirect('back')` and `res.location('back')` is no longer a supported magic string, explicitly use `req.get('Referrer') || '/'`.104* change:105 - `res.clearCookie` will ignore user provided `maxAge` and `expires` options106* deps: cookie-signature@^1.2.1107* deps: debug@4.3.6108* deps: merge-descriptors@^2.0.0109* deps: serve-static@^2.1.0110* deps: qs@6.13.0111* deps: accepts@^2.0.0112* deps: mime-types@^3.0.0113 - `application/javascript` => `text/javascript`114* deps: type-is@^2.0.0115* deps: content-disposition@^1.0.0116* deps: finalhandler@^2.0.0117* deps: fresh@^2.0.0118* deps: body-parser@^2.0.1119* deps: send@^1.1.01201215.0.0-beta.3 / 2024-03-25122=========================123124This incorporates all changes after 4.19.1 up to 4.19.2.1251265.0.0-beta.2 / 2024-03-20127=========================128129This incorporates all changes after 4.17.2 up to 4.19.1.1301315.0.0-beta.1 / 2022-02-14132=========================133134This is the first Express 5.0 beta release, based off 4.17.2 and includes135changes from 5.0.0-alpha.8.136137 * change:138 - Default "query parser" setting to `'simple'`139 - Requires Node.js 4+140 - Use `mime-types` for file to content type mapping141 * deps: array-flatten@3.0.0142 * deps: body-parser@2.0.0-beta.1143 - `req.body` is no longer always initialized to `{}`144 - `urlencoded` parser now defaults `extended` to `false`145 - Use `on-finished` to determine when body read146 * deps: router@2.0.0-beta.1147 - Add new `?`, `*`, and `+` parameter modifiers148 - Internalize private `router.process_params` method149 - Matching group expressions are only RegExp syntax150 - Named matching groups no longer available by position in `req.params`151 - Regular expressions can only be used in a matching group152 - Remove `debug` dependency153 - Special `*` path segment behavior removed154 - deps: array-flatten@3.0.0155 - deps: parseurl@~1.3.3156 - deps: path-to-regexp@3.2.0157 - deps: setprototypeof@1.2.0158 * deps: send@1.0.0-beta.1159 - Change `dotfiles` option default to `'ignore'`160 - Remove `hidden` option; use `dotfiles` option instead161 - Use `mime-types` for file to content type mapping162 - deps: debug@3.1.0163 * deps: serve-static@2.0.0-beta.1164 - Change `dotfiles` option default to `'ignore'`165 - Remove `hidden` option; use `dotfiles` option instead166 - Use `mime-types` for file to content type mapping167 - Remove `express.static.mime` export; use `mime-types` package instead168 - deps: send@1.0.0-beta.11691705.0.0-alpha.8 / 2020-03-25171==========================172173This is the eighth Express 5.0 alpha release, based off 4.17.1 and includes174changes from 5.0.0-alpha.7.1751765.0.0-alpha.7 / 2018-10-26177==========================178179This is the seventh Express 5.0 alpha release, based off 4.16.4 and includes180changes from 5.0.0-alpha.6.181182The major change with this alpha is the basic support for returned, rejected183Promises in the router.184185 * remove:186 - `path-to-regexp` dependency187 * deps: debug@3.1.0188 - Add `DEBUG_HIDE_DATE` environment variable189 - Change timer to per-namespace instead of global190 - Change non-TTY date format191 - Remove `DEBUG_FD` environment variable support192 - Support 256 namespace colors193 * deps: router@2.0.0-alpha.1194 - Add basic support for returned, rejected Promises195 - Fix JSDoc for `Router` constructor196 - deps: debug@3.1.0197 - deps: parseurl@~1.3.2198 - deps: setprototypeof@1.1.0199 - deps: utils-merge@1.0.12002015.0.0-alpha.6 / 2017-09-24202==========================203204This is the sixth Express 5.0 alpha release, based off 4.15.5 and includes205changes from 5.0.0-alpha.5.206207 * remove:208 - `res.redirect(url, status)` signature - use `res.redirect(status, url)`209 - `res.send(status, body)` signature - use `res.status(status).send(body)`210 * deps: router@~1.3.1211 - deps: debug@2.6.82122135.0.0-alpha.5 / 2017-03-06214==========================215216This is the fifth Express 5.0 alpha release, based off 4.15.2 and includes217changes from 5.0.0-alpha.4.2182195.0.0-alpha.4 / 2017-03-01220==========================221222This is the fourth Express 5.0 alpha release, based off 4.15.0 and includes223changes from 5.0.0-alpha.3.224225 * remove:226 - Remove Express 3.x middleware error stubs227 * deps: router@~1.3.0228 - Add `next("router")` to exit from router229 - Fix case where `router.use` skipped requests routes did not230 - Skip routing when `req.url` is not set231 - Use `%o` in path debug to tell types apart232 - deps: debug@2.6.1233 - deps: setprototypeof@1.0.3234 - perf: add fast match path for `*` route2352365.0.0-alpha.3 / 2017-01-28237==========================238239This is the third Express 5.0 alpha release, based off 4.14.1 and includes240changes from 5.0.0-alpha.2.241242 * remove:243 - `res.json(status, obj)` signature - use `res.status(status).json(obj)`244 - `res.jsonp(status, obj)` signature - use `res.status(status).jsonp(obj)`245 - `res.vary()` (no arguments) -- provide a field name as an argument246 * deps: array-flatten@2.1.1247 * deps: path-is-absolute@1.0.1248 * deps: router@~1.1.5249 - deps: array-flatten@2.0.1250 - deps: methods@~1.1.2251 - deps: parseurl@~1.3.1252 - deps: setprototypeof@1.0.22532545.0.0-alpha.2 / 2015-07-06255==========================256257This is the second Express 5.0 alpha release, based off 4.13.1 and includes258changes from 5.0.0-alpha.1.259260 * remove:261 - `app.param(fn)`262 - `req.param()` -- use `req.params`, `req.body`, or `req.query` instead263 * change:264 - `res.render` callback is always async, even for sync view engines265 - The leading `:` character in `name` for `app.param(name, fn)` is no longer removed266 - Use `router` module for routing267 - Use `path-is-absolute` module for absolute path detection2682695.0.0-alpha.1 / 2014-11-06270==========================271272This is the first Express 5.0 alpha release, based off 4.10.1.273274 * remove:275 - `app.del` - use `app.delete`276 - `req.acceptsCharset` - use `req.acceptsCharsets`277 - `req.acceptsEncoding` - use `req.acceptsEncodings`278 - `req.acceptsLanguage` - use `req.acceptsLanguages`279 - `res.json(obj, status)` signature - use `res.json(status, obj)`280 - `res.jsonp(obj, status)` signature - use `res.jsonp(status, obj)`281 - `res.send(body, status)` signature - use `res.send(status, body)`282 - `res.send(status)` signature - use `res.sendStatus(status)`283 - `res.sendfile` - use `res.sendFile` instead284 - `express.query` middleware285 * change:286 - `req.host` now returns host (`hostname:port`) - use `req.hostname` for only hostname287 - `req.query` is now a getter instead of a plain property288 * add:289 - `app.router` is a reference to the base router2902914.20.0 / 2024-09-10292==========293 * deps: serve-static@0.16.0294 * Remove link renderization in html while redirecting295 * deps: send@0.19.0296 * Remove link renderization in html while redirecting297 * deps: body-parser@0.6.0298 * add `depth` option to customize the depth level in the parser299 * IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`)300 * Remove link renderization in html while using `res.redirect`301 * deps: path-to-regexp@0.1.10302 - Adds support for named matching groups in the routes using a regex303 - Adds backtracking protection to parameters without regexes defined304 * deps: encodeurl@~2.0.0305 - Removes encoding of `\`, `|`, and `^` to align better with URL spec306 * Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie`307 - Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie3083094.19.2 / 2024-03-25310==========311312 * Improved fix for open redirect allow list bypass3133144.19.1 / 2024-03-20315==========316317 * Allow passing non-strings to res.location with new encoding handling checks3183194.19.0 / 2024-03-20320==========321322 * Prevent open redirect allow list bypass due to encodeurl323 * deps: cookie@0.6.03243254.18.3 / 2024-02-29326==========327328 * Fix routing requests without method329 * deps: body-parser@1.20.2330 - Fix strict json error message on Node.js 19+331 - deps: content-type@~1.0.5332 - deps: raw-body@2.5.2333 * deps: cookie@0.6.0334 - Add `partitioned` option3353364.18.2 / 2022-10-08337===================338339 * Fix regression routing a large stack in a single route340 * deps: body-parser@1.20.1341 - deps: qs@6.11.0342 - perf: remove unnecessary object clone343 * deps: qs@6.11.03443454.18.1 / 2022-04-29346===================347348 * Fix hanging on large stack of sync routes3493504.18.0 / 2022-04-25351===================352353 * Add "root" option to `res.download`354 * Allow `options` without `filename` in `res.download`355 * Deprecate string and non-integer arguments to `res.status`356 * Fix behavior of `null`/`undefined` as `maxAge` in `res.cookie`357 * Fix handling very large stacks of sync middleware358 * Ignore `Object.prototype` values in settings through `app.set`/`app.get`359 * Invoke `default` with same arguments as types in `res.format`360 * Support proper 205 responses using `res.send`361 * Use `http-errors` for `res.format` error362 * deps: body-parser@1.20.0363 - Fix error message for json parse whitespace in `strict`364 - Fix internal error when inflated body exceeds limit365 - Prevent loss of async hooks context366 - Prevent hanging when request already read367 - deps: depd@2.0.0368 - deps: http-errors@2.0.0369 - deps: on-finished@2.4.1370 - deps: qs@6.10.3371 - deps: raw-body@2.5.1372 * deps: cookie@0.5.0373 - Add `priority` option374 - Fix `expires` option to reject invalid dates375 * deps: depd@2.0.0376 - Replace internal `eval` usage with `Function` constructor377 - Use instance methods on `process` to check for listeners378 * deps: finalhandler@1.2.0379 - Remove set content headers that break response380 - deps: on-finished@2.4.1381 - deps: statuses@2.0.1382 * deps: on-finished@2.4.1383 - Prevent loss of async hooks context384 * deps: qs@6.10.3385 * deps: send@0.18.0386 - Fix emitted 416 error missing headers property387 - Limit the headers removed for 304 response388 - deps: depd@2.0.0389 - deps: destroy@1.2.0390 - deps: http-errors@2.0.0391 - deps: on-finished@2.4.1392 - deps: statuses@2.0.1393 * deps: serve-static@1.15.0394 - deps: send@0.18.0395 * deps: statuses@2.0.1396 - Remove code 306397 - Rename `425 Unordered Collection` to standard `425 Too Early`3983994.17.3 / 2022-02-16400===================401402 * deps: accepts@~1.3.8403 - deps: mime-types@~2.1.34404 - deps: negotiator@0.6.3405 * deps: body-parser@1.19.2406 - deps: bytes@3.1.2407 - deps: qs@6.9.7408 - deps: raw-body@2.4.3409 * deps: cookie@0.4.2410 * deps: qs@6.9.7411 * Fix handling of `__proto__` keys412 * pref: remove unnecessary regexp for trust proxy4134144.17.2 / 2021-12-16415===================416417 * Fix handling of `undefined` in `res.jsonp`418 * Fix handling of `undefined` when `"json escape"` is enabled419 * Fix incorrect middleware execution with unanchored `RegExp`s420 * Fix `res.jsonp(obj, status)` deprecation message421 * Fix typo in `res.is` JSDoc422 * deps: body-parser@1.19.1423 - deps: bytes@3.1.1424 - deps: http-errors@1.8.1425 - deps: qs@6.9.6426 - deps: raw-body@2.4.2427 - deps: safe-buffer@5.2.1428 - deps: type-is@~1.6.18429 * deps: content-disposition@0.5.4430 - deps: safe-buffer@5.2.1431 * deps: cookie@0.4.1432 - Fix `maxAge` option to reject invalid values433 * deps: proxy-addr@~2.0.7434 - Use `req.socket` over deprecated `req.connection`435 - deps: forwarded@0.2.0436 - deps: ipaddr.js@1.9.1437 * deps: qs@6.9.6438 * deps: safe-buffer@5.2.1439 * deps: send@0.17.2440 - deps: http-errors@1.8.1441 - deps: ms@2.1.3442 - pref: ignore empty http tokens443 * deps: serve-static@1.14.2444 - deps: send@0.17.2445 * deps: setprototypeof@1.2.04464474.17.1 / 2019-05-25448===================449450 * Revert "Improve error message for `null`/`undefined` to `res.status`"4514524.17.0 / 2019-05-16453===================454455 * Add `express.raw` to parse bodies into `Buffer`456 * Add `express.text` to parse bodies into string457 * Improve error message for non-strings to `res.sendFile`458 * Improve error message for `null`/`undefined` to `res.status`459 * Support multiple hosts in `X-Forwarded-Host`460 * deps: accepts@~1.3.7461 * deps: body-parser@1.19.0462 - Add encoding MIK463 - Add petabyte (`pb`) support464 - Fix parsing array brackets after index465 - deps: bytes@3.1.0466 - deps: http-errors@1.7.2467 - deps: iconv-lite@0.4.24468 - deps: qs@6.7.0469 - deps: raw-body@2.4.0470 - deps: type-is@~1.6.17471 * deps: content-disposition@0.5.3472 * deps: cookie@0.4.0473 - Add `SameSite=None` support474 * deps: finalhandler@~1.1.2475 - Set stricter `Content-Security-Policy` header476 - deps: parseurl@~1.3.3477 - deps: statuses@~1.5.0478 * deps: parseurl@~1.3.3479 * deps: proxy-addr@~2.0.5480 - deps: ipaddr.js@1.9.0481 * deps: qs@6.7.0482 - Fix parsing array brackets after index483 * deps: range-parser@~1.2.1484 * deps: send@0.17.1485 - Set stricter CSP header in redirect & error responses486 - deps: http-errors@~1.7.2487 - deps: mime@1.6.0488 - deps: ms@2.1.1489 - deps: range-parser@~1.2.1490 - deps: statuses@~1.5.0491 - perf: remove redundant `path.normalize` call492 * deps: serve-static@1.14.1493 - Set stricter CSP header in redirect response494 - deps: parseurl@~1.3.3495 - deps: send@0.17.1496 * deps: setprototypeof@1.1.1497 * deps: statuses@~1.5.0498 - Add `103 Early Hints`499 * deps: type-is@~1.6.18500 - deps: mime-types@~2.1.24501 - perf: prevent internal `throw` on invalid type5025034.16.4 / 2018-10-10504===================505506 * Fix issue where `"Request aborted"` may be logged in `res.sendfile`507 * Fix JSDoc for `Router` constructor508 * deps: body-parser@1.18.3509 - Fix deprecation warnings on Node.js 10+510 - Fix stack trace for strict json parse error511 - deps: depd@~1.1.2512 - deps: http-errors@~1.6.3513 - deps: iconv-lite@0.4.23514 - deps: qs@6.5.2515 - deps: raw-body@2.3.3516 - deps: type-is@~1.6.16517 * deps: proxy-addr@~2.0.4518 - deps: ipaddr.js@1.8.0519 * deps: qs@6.5.2520 * deps: safe-buffer@5.1.25215224.16.3 / 2018-03-12523===================524525 * deps: accepts@~1.3.5526 - deps: mime-types@~2.1.18527 * deps: depd@~1.1.2528 - perf: remove argument reassignment529 * deps: encodeurl@~1.0.2530 - Fix encoding `%` as last character531 * deps: finalhandler@1.1.1532 - Fix 404 output for bad / missing pathnames533 - deps: encodeurl@~1.0.2534 - deps: statuses@~1.4.0535 * deps: proxy-addr@~2.0.3536 - deps: ipaddr.js@1.6.0537 * deps: send@0.16.2538 - Fix incorrect end tag in default error & redirects539 - deps: depd@~1.1.2540 - deps: encodeurl@~1.0.2541 - deps: statuses@~1.4.0542 * deps: serve-static@1.13.2543 - Fix incorrect end tag in redirects544 - deps: encodeurl@~1.0.2545 - deps: send@0.16.2546 * deps: statuses@~1.4.0547 * deps: type-is@~1.6.16548 - deps: mime-types@~2.1.185495504.16.2 / 2017-10-09551===================552553 * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set554 * perf: skip parsing of entire `X-Forwarded-Proto` header5555564.16.1 / 2017-09-29557===================558559 * deps: send@0.16.1560 * deps: serve-static@1.13.1561 - Fix regression when `root` is incorrectly set to a file562 - deps: send@0.16.15635644.16.0 / 2017-09-28565===================566567 * Add `"json escape"` setting for `res.json` and `res.jsonp`568 * Add `express.json` and `express.urlencoded` to parse bodies569 * Add `options` argument to `res.download`570 * Improve error message when autoloading invalid view engine571 * Improve error messages when non-function provided as middleware572 * Skip `Buffer` encoding when not generating ETag for small response573 * Use `safe-buffer` for improved Buffer API574 * deps: accepts@~1.3.4575 - deps: mime-types@~2.1.16576 * deps: content-type@~1.0.4577 - perf: remove argument reassignment578 - perf: skip parameter parsing when no parameters579 * deps: etag@~1.8.1580 - perf: replace regular expression with substring581 * deps: finalhandler@1.1.0582 - Use `res.headersSent` when available583 * deps: parseurl@~1.3.2584 - perf: reduce overhead for full URLs585 - perf: unroll the "fast-path" `RegExp`586 * deps: proxy-addr@~2.0.2587 - Fix trimming leading / trailing OWS in `X-Forwarded-For`588 - deps: forwarded@~0.1.2589 - deps: ipaddr.js@1.5.2590 - perf: reduce overhead when no `X-Forwarded-For` header591 * deps: qs@6.5.1592 - Fix parsing & compacting very deep objects593 * deps: send@0.16.0594 - Add 70 new types for file extensions595 - Add `immutable` option596 - Fix missing `</html>` in default error & redirects597 - Set charset as "UTF-8" for .js and .json598 - Use instance methods on steam to check for listeners599 - deps: mime@1.4.1600 - perf: improve path validation speed601 * deps: serve-static@1.13.0602 - Add 70 new types for file extensions603 - Add `immutable` option604 - Set charset as "UTF-8" for .js and .json605 - deps: send@0.16.0606 * deps: setprototypeof@1.1.0607 * deps: utils-merge@1.0.1608 * deps: vary@~1.1.2609 - perf: improve header token parsing speed610 * perf: reuse options object when generating ETags611 * perf: remove dead `.charset` set in `res.jsonp`6126134.15.5 / 2017-09-24614===================615616 * deps: debug@2.6.9617 * deps: finalhandler@~1.0.6618 - deps: debug@2.6.9619 - deps: parseurl@~1.3.2620 * deps: fresh@0.5.2621 - Fix handling of modified headers with invalid dates622 - perf: improve ETag match loop623 - perf: improve `If-None-Match` token parsing624 * deps: send@0.15.6625 - Fix handling of modified headers with invalid dates626 - deps: debug@2.6.9627 - deps: etag@~1.8.1628 - deps: fresh@0.5.2629 - perf: improve `If-Match` token parsing630 * deps: serve-static@1.12.6631 - deps: parseurl@~1.3.2632 - deps: send@0.15.6633 - perf: improve slash collapsing6346354.15.4 / 2017-08-06636===================637638 * deps: debug@2.6.8639 * deps: depd@~1.1.1640 - Remove unnecessary `Buffer` loading641 * deps: finalhandler@~1.0.4642 - deps: debug@2.6.8643 * deps: proxy-addr@~1.1.5644 - Fix array argument being altered645 - deps: ipaddr.js@1.4.0646 * deps: qs@6.5.0647 * deps: send@0.15.4648 - deps: debug@2.6.8649 - deps: depd@~1.1.1650 - deps: http-errors@~1.6.2651 * deps: serve-static@1.12.4652 - deps: send@0.15.46536544.15.3 / 2017-05-16655===================656657 * Fix error when `res.set` cannot add charset to `Content-Type`658 * deps: debug@2.6.7659 - Fix `DEBUG_MAX_ARRAY_LENGTH`660 - deps: ms@2.0.0661 * deps: finalhandler@~1.0.3662 - Fix missing `</html>` in HTML document663 - deps: debug@2.6.7664 * deps: proxy-addr@~1.1.4665 - deps: ipaddr.js@1.3.0666 * deps: send@0.15.3667 - deps: debug@2.6.7668 - deps: ms@2.0.0669 * deps: serve-static@1.12.3670 - deps: send@0.15.3671 * deps: type-is@~1.6.15672 - deps: mime-types@~2.1.15673 * deps: vary@~1.1.1674 - perf: hoist regular expression6756764.15.2 / 2017-03-06677===================678679 * deps: qs@6.4.0680 - Fix regression parsing keys starting with `[`6816824.15.1 / 2017-03-05683===================684685 * deps: send@0.15.1686 - Fix issue when `Date.parse` does not return `NaN` on invalid date687 - Fix strict violation in broken environments688 * deps: serve-static@1.12.1689 - Fix issue when `Date.parse` does not return `NaN` on invalid date690 - deps: send@0.15.16916924.15.0 / 2017-03-01693===================694695 * Add debug message when loading view engine696 * Add `next("router")` to exit from router697 * Fix case where `router.use` skipped requests routes did not698 * Remove usage of `res._headers` private field699 - Improves compatibility with Node.js 8 nightly700 * Skip routing when `req.url` is not set701 * Use `%o` in path debug to tell types apart702 * Use `Object.create` to setup request & response prototypes703 * Use `setprototypeof` module to replace `__proto__` setting704 * Use `statuses` instead of `http` module for status messages705 * deps: debug@2.6.1706 - Allow colors in workers707 - Deprecated `DEBUG_FD` environment variable set to `3` or higher708 - Fix error when running under React Native709 - Use same color for same namespace710 - deps: ms@0.7.2711 * deps: etag@~1.8.0712 - Use SHA1 instead of MD5 for ETag hashing713 - Works with FIPS 140-2 OpenSSL configuration714 * deps: finalhandler@~1.0.0715 - Fix exception when `err` cannot be converted to a string716 - Fully URL-encode the pathname in the 404717 - Only include the pathname in the 404 message718 - Send complete HTML document719 - Set `Content-Security-Policy: default-src 'self'` header720 - deps: debug@2.6.1721 * deps: fresh@0.5.0722 - Fix false detection of `no-cache` request directive723 - Fix incorrect result when `If-None-Match` has both `*` and ETags724 - Fix weak `ETag` matching to match spec725 - perf: delay reading header values until needed726 - perf: enable strict mode727 - perf: hoist regular expressions728 - perf: remove duplicate conditional729 - perf: remove unnecessary boolean coercions730 - perf: skip checking modified time if ETag check failed731 - perf: skip parsing `If-None-Match` when no `ETag` header732 - perf: use `Date.parse` instead of `new Date`733 * deps: qs@6.3.1734 - Fix array parsing from skipping empty values735 - Fix compacting nested arrays736 * deps: send@0.15.0737 - Fix false detection of `no-cache` request directive738 - Fix incorrect result when `If-None-Match` has both `*` and ETags739 - Fix weak `ETag` matching to match spec740 - Remove usage of `res._headers` private field741 - Support `If-Match` and `If-Unmodified-Since` headers742 - Use `res.getHeaderNames()` when available743 - Use `res.headersSent` when available744 - deps: debug@2.6.1745 - deps: etag@~1.8.0746 - deps: fresh@0.5.0747 - deps: http-errors@~1.6.1748 * deps: serve-static@1.12.0749 - Fix false detection of `no-cache` request directive750 - Fix incorrect result when `If-None-Match` has both `*` and ETags751 - Fix weak `ETag` matching to match spec752 - Remove usage of `res._headers` private field753 - Send complete HTML document in redirect response754 - Set default CSP header in redirect response755 - Support `If-Match` and `If-Unmodified-Since` headers756 - Use `res.getHeaderNames()` when available757 - Use `res.headersSent` when available758 - deps: send@0.15.0759 * perf: add fast match path for `*` route760 * perf: improve `req.ips` performance7617624.14.1 / 2017-01-28763===================764765 * deps: content-disposition@0.5.2766 * deps: finalhandler@0.5.1767 - Fix exception when `err.headers` is not an object768 - deps: statuses@~1.3.1769 - perf: hoist regular expressions770 - perf: remove duplicate validation path771 * deps: proxy-addr@~1.1.3772 - deps: ipaddr.js@1.2.0773 * deps: send@0.14.2774 - deps: http-errors@~1.5.1775 - deps: ms@0.7.2776 - deps: statuses@~1.3.1777 * deps: serve-static@~1.11.2778 - deps: send@0.14.2779 * deps: type-is@~1.6.14780 - deps: mime-types@~2.1.137817824.14.0 / 2016-06-16783===================784785 * Add `acceptRanges` option to `res.sendFile`/`res.sendfile`786 * Add `cacheControl` option to `res.sendFile`/`res.sendfile`787 * Add `options` argument to `req.range`788 - Includes the `combine` option789 * Encode URL in `res.location`/`res.redirect` if not already encoded790 * Fix some redirect handling in `res.sendFile`/`res.sendfile`791 * Fix Windows absolute path check using forward slashes792 * Improve error with invalid arguments to `req.get()`793 * Improve performance for `res.json`/`res.jsonp` in most cases794 * Improve `Range` header handling in `res.sendFile`/`res.sendfile`795 * deps: accepts@~1.3.3796 - Fix including type extensions in parameters in `Accept` parsing797 - Fix parsing `Accept` parameters with quoted equals798 - Fix parsing `Accept` parameters with quoted semicolons799 - Many performance improvements800 - deps: mime-types@~2.1.11801 - deps: negotiator@0.6.1802 * deps: content-type@~1.0.2803 - perf: enable strict mode804 * deps: cookie@0.3.1805 - Add `sameSite` option806 - Fix cookie `Max-Age` to never be a floating point number807 - Improve error message when `encode` is not a function808 - Improve error message when `expires` is not a `Date`809 - Throw better error for invalid argument to parse810 - Throw on invalid values provided to `serialize`811 - perf: enable strict mode812 - perf: hoist regular expression813 - perf: use for loop in parse814 - perf: use string concatenation for serialization815 * deps: finalhandler@0.5.0816 - Change invalid or non-numeric status code to 500817 - Overwrite status message to match set status code818 - Prefer `err.statusCode` if `err.status` is invalid819 - Set response headers from `err.headers` object820 - Use `statuses` instead of `http` module for status messages821 * deps: proxy-addr@~1.1.2822 - Fix accepting various invalid netmasks823 - Fix IPv6-mapped IPv4 validation edge cases824 - IPv4 netmasks must be contiguous825 - IPv6 addresses cannot be used as a netmask826 - deps: ipaddr.js@1.1.1827 * deps: qs@6.2.0828 - Add `decoder` option in `parse` function829 * deps: range-parser@~1.2.0830 - Add `combine` option to combine overlapping ranges831 - Fix incorrectly returning -1 when there is at least one valid range832 - perf: remove internal function833 * deps: send@0.14.1834 - Add `acceptRanges` option835 - Add `cacheControl` option836 - Attempt to combine multiple ranges into single range837 - Correctly inherit from `Stream` class838 - Fix `Content-Range` header in 416 responses when using `start`/`end` options839 - Fix `Content-Range` header missing from default 416 responses840 - Fix redirect error when `path` contains raw non-URL characters841 - Fix redirect when `path` starts with multiple forward slashes842 - Ignore non-byte `Range` headers843 - deps: http-errors@~1.5.0844 - deps: range-parser@~1.2.0845 - deps: statuses@~1.3.0846 - perf: remove argument reassignment847 * deps: serve-static@~1.11.1848 - Add `acceptRanges` option849 - Add `cacheControl` option850 - Attempt to combine multiple ranges into single range851 - Fix redirect error when `req.url` contains raw non-URL characters852 - Ignore non-byte `Range` headers853 - Use status code 301 for redirects854 - deps: send@0.14.1855 * deps: type-is@~1.6.13856 - Fix type error when given invalid type to match against857 - deps: mime-types@~2.1.11858 * deps: vary@~1.1.0859 - Only accept valid field names in the `field` argument860 * perf: use strict equality when possible8618624.13.4 / 2016-01-21863===================864865 * deps: content-disposition@0.5.1866 - perf: enable strict mode867 * deps: cookie@0.1.5868 - Throw on invalid values provided to `serialize`869 * deps: depd@~1.1.0870 - Support web browser loading871 - perf: enable strict mode872 * deps: escape-html@~1.0.3873 - perf: enable strict mode874 - perf: optimize string replacement875 - perf: use faster string coercion876 * deps: finalhandler@0.4.1877 - deps: escape-html@~1.0.3878 * deps: merge-descriptors@1.0.1879 - perf: enable strict mode880 * deps: methods@~1.1.2881 - perf: enable strict mode882 * deps: parseurl@~1.3.1883 - perf: enable strict mode884 * deps: proxy-addr@~1.0.10885 - deps: ipaddr.js@1.0.5886 - perf: enable strict mode887 * deps: range-parser@~1.0.3888 - perf: enable strict mode889 * deps: send@0.13.1890 - deps: depd@~1.1.0891 - deps: destroy@~1.0.4892 - deps: escape-html@~1.0.3893 - deps: range-parser@~1.0.3894 * deps: serve-static@~1.10.2895 - deps: escape-html@~1.0.3896 - deps: parseurl@~1.3.0897 - deps: send@0.13.18988994.13.3 / 2015-08-02900===================901902 * Fix infinite loop condition using `mergeParams: true`903 * Fix inner numeric indices incorrectly altering parent `req.params`9049054.13.2 / 2015-07-31906===================907908 * deps: accepts@~1.2.12909 - deps: mime-types@~2.1.4910 * deps: array-flatten@1.1.1911 - perf: enable strict mode912 * deps: path-to-regexp@0.1.7913 - Fix regression with escaped round brackets and matching groups914 * deps: type-is@~1.6.6915 - deps: mime-types@~2.1.49169174.13.1 / 2015-07-05918===================919920 * deps: accepts@~1.2.10921 - deps: mime-types@~2.1.2922 * deps: qs@4.0.0923 - Fix dropping parameters like `hasOwnProperty`924 - Fix various parsing edge cases925 * deps: type-is@~1.6.4926 - deps: mime-types@~2.1.2927 - perf: enable strict mode928 - perf: remove argument reassignment9299304.13.0 / 2015-06-20931===================932933 * Add settings to debug output934 * Fix `res.format` error when only `default` provided935 * Fix issue where `next('route')` in `app.param` would incorrectly skip values936 * Fix hiding platform issues with `decodeURIComponent`937 - Only `URIError`s are a 400938 * Fix using `*` before params in routes939 * Fix using capture groups before params in routes940 * Simplify `res.cookie` to call `res.append`941 * Use `array-flatten` module for flattening arrays942 * deps: accepts@~1.2.9943 - deps: mime-types@~2.1.1944 - perf: avoid argument reassignment & argument slice945 - perf: avoid negotiator recursive construction946 - perf: enable strict mode947 - perf: remove unnecessary bitwise operator948 * deps: cookie@0.1.3949 - perf: deduce the scope of try-catch deopt950 - perf: remove argument reassignments951 * deps: escape-html@1.0.2952 * deps: etag@~1.7.0953 - Always include entity length in ETags for hash length extensions954 - Generate non-Stats ETags using MD5 only (no longer CRC32)955 - Improve stat performance by removing hashing956 - Improve support for JXcore957 - Remove base64 padding in ETags to shorten958 - Support "fake" stats objects in environments without fs959 - Use MD5 instead of MD4 in weak ETags over 1KB960 * deps: finalhandler@0.4.0961 - Fix a false-positive when unpiping in Node.js 0.8962 - Support `statusCode` property on `Error` objects963 - Use `unpipe` module for unpiping requests964 - deps: escape-html@1.0.2965 - deps: on-finished@~2.3.0966 - perf: enable strict mode967 - perf: remove argument reassignment968 * deps: fresh@0.3.0969 - Add weak `ETag` matching support970 * deps: on-finished@~2.3.0971 - Add defined behavior for HTTP `CONNECT` requests972 - Add defined behavior for HTTP `Upgrade` requests973 - deps: ee-first@1.1.1974 * deps: path-to-regexp@0.1.6975 * deps: send@0.13.0976 - Allow Node.js HTTP server to set `Date` response header977 - Fix incorrectly removing `Content-Location` on 304 response978 - Improve the default redirect response headers979 - Send appropriate headers on default error response980 - Use `http-errors` for standard emitted errors981 - Use `statuses` instead of `http` module for status messages982 - deps: escape-html@1.0.2983 - deps: etag@~1.7.0984 - deps: fresh@0.3.0985 - deps: on-finished@~2.3.0986 - perf: enable strict mode987 - perf: remove unnecessary array allocations988 * deps: serve-static@~1.10.0989 - Add `fallthrough` option990 - Fix reading options from options prototype991 - Improve the default redirect response headers992 - Malformed URLs now `next()` instead of 400993 - deps: escape-html@1.0.2994 - deps: send@0.13.0995 - perf: enable strict mode996 - perf: remove argument reassignment997 * deps: type-is@~1.6.3998 - deps: mime-types@~2.1.1999 - perf: reduce try block size1000 - perf: remove bitwise operations1001 * perf: enable strict mode1002 * perf: isolate `app.render` try block1003 * perf: remove argument reassignments in application1004 * perf: remove argument reassignments in request prototype1005 * perf: remove argument reassignments in response prototype1006 * perf: remove argument reassignments in routing1007 * perf: remove argument reassignments in `View`1008 * perf: skip attempting to decode zero length string1009 * perf: use saved reference to `http.STATUS_CODES`101010114.12.4 / 2015-05-171012===================10131014 * deps: accepts@~1.2.71015 - deps: mime-types@~2.0.111016 - deps: negotiator@0.5.31017 * deps: debug@~2.2.01018 - deps: ms@0.7.11019 * deps: depd@~1.0.11020 * deps: etag@~1.6.01021 - Improve support for JXcore1022 - Support "fake" stats objects in environments without `fs`1023 * deps: finalhandler@0.3.61024 - deps: debug@~2.2.01025 - deps: on-finished@~2.2.11026 * deps: on-finished@~2.2.11027 - Fix `isFinished(req)` when data buffered1028 * deps: proxy-addr@~1.0.81029 - deps: ipaddr.js@1.0.11030 * deps: qs@2.4.21031 - Fix allowing parameters like `constructor`1032 * deps: send@0.12.31033 - deps: debug@~2.2.01034 - deps: depd@~1.0.11035 - deps: etag@~1.6.01036 - deps: ms@0.7.11037 - deps: on-finished@~2.2.11038 * deps: serve-static@~1.9.31039 - deps: send@0.12.31040 * deps: type-is@~1.6.21041 - deps: mime-types@~2.0.11104210434.12.3 / 2015-03-171044===================10451046 * deps: accepts@~1.2.51047 - deps: mime-types@~2.0.101048 * deps: debug@~2.1.31049 - Fix high intensity foreground color for bold1050 - deps: ms@0.7.01051 * deps: finalhandler@0.3.41052 - deps: debug@~2.1.31053 * deps: proxy-addr@~1.0.71054 - deps: ipaddr.js@0.1.91055 * deps: qs@2.4.11056 - Fix error when parameter `hasOwnProperty` is present1057 * deps: send@0.12.21058 - Throw errors early for invalid `extensions` or `index` options1059 - deps: debug@~2.1.31060 * deps: serve-static@~1.9.21061 - deps: send@0.12.21062 * deps: type-is@~1.6.11063 - deps: mime-types@~2.0.10106410654.12.2 / 2015-03-021066===================10671068 * Fix regression where `"Request aborted"` is logged using `res.sendFile`106910704.12.1 / 2015-03-011071===================10721073 * Fix constructing application with non-configurable prototype properties1074 * Fix `ECONNRESET` errors from `res.sendFile` usage1075 * Fix `req.host` when using "trust proxy" hops count1076 * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count1077 * Fix wrong `code` on aborted connections from `res.sendFile`1078 * deps: merge-descriptors@1.0.0107910804.12.0 / 2015-02-231081===================10821083 * Fix `"trust proxy"` setting to inherit when app is mounted1084 * Generate `ETag`s for all request responses1085 - No longer restricted to only responses for `GET` and `HEAD` requests1086 * Use `content-type` to parse `Content-Type` headers1087 * deps: accepts@~1.2.41088 - Fix preference sorting to be stable for long acceptable lists1089 - deps: mime-types@~2.0.91090 - deps: negotiator@0.5.11091 * deps: cookie-signature@1.0.61092 * deps: send@0.12.11093 - Always read the stat size from the file1094 - Fix mutating passed-in `options`1095 - deps: mime@1.3.41096 * deps: serve-static@~1.9.11097 - deps: send@0.12.11098 * deps: type-is@~1.6.01099 - fix argument reassignment1100 - fix false-positives in `hasBody` `Transfer-Encoding` check1101 - support wildcard for both type and subtype (`*/*`)1102 - deps: mime-types@~2.0.9110311044.11.2 / 2015-02-011105===================11061107 * Fix `res.redirect` double-calling `res.end` for `HEAD` requests1108 * deps: accepts@~1.2.31109 - deps: mime-types@~2.0.81110 * deps: proxy-addr@~1.0.61111 - deps: ipaddr.js@0.1.81112 * deps: type-is@~1.5.61113 - deps: mime-types@~2.0.8111411154.11.1 / 2015-01-201116===================11171118 * deps: send@0.11.11119 - Fix root path disclosure1120 * deps: serve-static@~1.8.11121 - Fix redirect loop in Node.js 0.11.141122 - Fix root path disclosure1123 - deps: send@0.11.1112411254.11.0 / 2015-01-131126===================11271128 * Add `res.append(field, val)` to append headers1129 * Deprecate leading `:` in `name` for `app.param(name, fn)`1130 * Deprecate `req.param()` -- use `req.params`, `req.body`, or `req.query` instead1131 * Deprecate `app.param(fn)`1132 * Fix `OPTIONS` responses to include the `HEAD` method properly1133 * Fix `res.sendFile` not always detecting aborted connection1134 * Match routes iteratively to prevent stack overflows1135 * deps: accepts@~1.2.21136 - deps: mime-types@~2.0.71137 - deps: negotiator@0.5.01138 * deps: send@0.11.01139 - deps: debug@~2.1.11140 - deps: etag@~1.5.11141 - deps: ms@0.7.01142 - deps: on-finished@~2.2.01143 * deps: serve-static@~1.8.01144 - deps: send@0.11.0114511464.10.8 / 2015-01-131147===================11481149 * Fix crash from error within `OPTIONS` response handler1150 * deps: proxy-addr@~1.0.51151 - deps: ipaddr.js@0.1.6115211534.10.7 / 2015-01-041154===================11551156 * Fix `Allow` header for `OPTIONS` to not contain duplicate methods1157 * Fix incorrect "Request aborted" for `res.sendFile` when `HEAD` or 3041158 * deps: debug@~2.1.11159 * deps: finalhandler@0.3.31160 - deps: debug@~2.1.11161 - deps: on-finished@~2.2.01162 * deps: methods@~1.1.11163 * deps: on-finished@~2.2.01164 * deps: serve-static@~1.7.21165 - Fix potential open redirect when mounted at root1166 * deps: type-is@~1.5.51167 - deps: mime-types@~2.0.7116811694.10.6 / 2014-12-121170===================11711172 * Fix exception in `req.fresh`/`req.stale` without response headers117311744.10.5 / 2014-12-101175===================11761177 * Fix `res.send` double-calling `res.end` for `HEAD` requests1178 * deps: accepts@~1.1.41179 - deps: mime-types@~2.0.41180 * deps: type-is@~1.5.41181 - deps: mime-types@~2.0.4118211834.10.4 / 2014-11-241184===================11851186 * Fix `res.sendfile` logging standard write errors118711884.10.3 / 2014-11-231189===================11901191 * Fix `res.sendFile` logging standard write errors1192 * deps: etag@~1.5.11193 * deps: proxy-addr@~1.0.41194 - deps: ipaddr.js@0.1.51195 * deps: qs@2.3.31196 - Fix `arrayLimit` behavior119711984.10.2 / 2014-11-091199===================12001201 * Correctly invoke async router callback asynchronously1202 * deps: accepts@~1.1.31203 - deps: mime-types@~2.0.31204 * deps: type-is@~1.5.31205 - deps: mime-types@~2.0.3120612074.10.1 / 2014-10-281208===================12091210 * Fix handling of URLs containing `://` in the path1211 * deps: qs@2.3.21212 - Fix parsing of mixed objects and values121312144.10.0 / 2014-10-231215===================12161217 * Add support for `app.set('views', array)`1218 - Views are looked up in sequence in array of directories1219 * Fix `res.send(status)` to mention `res.sendStatus(status)`1220 * Fix handling of invalid empty URLs1221 * Use `content-disposition` module for `res.attachment`/`res.download`1222 - Sends standards-compliant `Content-Disposition` header1223 - Full Unicode support1224 * Use `path.resolve` in view lookup1225 * deps: debug@~2.1.01226 - Implement `DEBUG_FD` env variable support1227 * deps: depd@~1.0.01228 * deps: etag@~1.5.01229 - Improve string performance1230 - Slightly improve speed for weak ETags over 1KB1231 * deps: finalhandler@0.3.21232 - Terminate in progress response only on error1233 - Use `on-finished` to determine request status1234 - deps: debug@~2.1.01235 - deps: on-finished@~2.1.11236 * deps: on-finished@~2.1.11237 - Fix handling of pipelined requests1238 * deps: qs@2.3.01239 - Fix parsing of mixed implicit and explicit arrays1240 * deps: send@0.10.11241 - deps: debug@~2.1.01242 - deps: depd@~1.0.01243 - deps: etag@~1.5.01244 - deps: on-finished@~2.1.11245 * deps: serve-static@~1.7.11246 - deps: send@0.10.1124712484.9.8 / 2014-10-171249==================12501251 * Fix `res.redirect` body when redirect status specified1252 * deps: accepts@~1.1.21253 - Fix error when media type has invalid parameter1254 - deps: negotiator@0.4.9125512564.9.7 / 2014-10-101257==================12581259 * Fix using same param name in array of paths126012614.9.6 / 2014-10-081262==================12631264 * deps: accepts@~1.1.11265 - deps: mime-types@~2.0.21266 - deps: negotiator@0.4.81267 * deps: serve-static@~1.6.41268 - Fix redirect loop when index file serving disabled1269 * deps: type-is@~1.5.21270 - deps: mime-types@~2.0.2127112724.9.5 / 2014-09-241273==================12741275 * deps: etag@~1.4.01276 * deps: proxy-addr@~1.0.31277 - Use `forwarded` npm module1278 * deps: send@0.9.31279 - deps: etag@~1.4.01280 * deps: serve-static@~1.6.31281 - deps: send@0.9.3128212834.9.4 / 2014-09-191284==================12851286 * deps: qs@2.2.41287 - Fix issue with object keys starting with numbers truncated128812894.9.3 / 2014-09-181290==================12911292 * deps: proxy-addr@~1.0.21293 - Fix a global leak when multiple subnets are trusted1294 - deps: ipaddr.js@0.1.3129512964.9.2 / 2014-09-171297==================12981299 * Fix regression for empty string `path` in `app.use`1300 * Fix `router.use` to accept array of middleware without path1301 * Improve error message for bad `app.use` arguments130213034.9.1 / 2014-09-161304==================13051306 * Fix `app.use` to accept array of middleware without path1307 * deps: depd@0.4.51308 * deps: etag@~1.3.11309 * deps: send@0.9.21310 - deps: depd@0.4.51311 - deps: etag@~1.3.11312 - deps: range-parser@~1.0.21313 * deps: serve-static@~1.6.21314 - deps: send@0.9.2131513164.9.0 / 2014-09-081317==================13181319 * Add `res.sendStatus`1320 * Invoke callback for sendfile when client aborts1321 - Applies to `res.sendFile`, `res.sendfile`, and `res.download`1322 - `err` will be populated with request aborted error1323 * Support IP address host in `req.subdomains`1324 * Use `etag` to generate `ETag` headers1325 * deps: accepts@~1.1.01326 - update `mime-types`1327 * deps: cookie-signature@1.0.51328 * deps: debug@~2.0.01329 * deps: finalhandler@0.2.01330 - Set `X-Content-Type-Options: nosniff` header1331 - deps: debug@~2.0.01332 * deps: fresh@0.2.41333 * deps: media-typer@0.3.01334 - Throw error when parameter format invalid on parse1335 * deps: qs@2.2.31336 - Fix issue where first empty value in array is discarded1337 * deps: range-parser@~1.0.21338 * deps: send@0.9.11339 - Add `lastModified` option1340 - Use `etag` to generate `ETag` header1341 - deps: debug@~2.0.01342 - deps: fresh@0.2.41343 * deps: serve-static@~1.6.11344 - Add `lastModified` option1345 - deps: send@0.9.11346 * deps: type-is@~1.5.11347 - fix `hasbody` to be true for `content-length: 0`1348 - deps: media-typer@0.3.01349 - deps: mime-types@~2.0.11350 * deps: vary@~1.0.01351 - Accept valid `Vary` header string as `field`135213534.8.8 / 2014-09-041354==================13551356 * deps: send@0.8.51357 - Fix a path traversal issue when using `root`1358 - Fix malicious path detection for empty string path1359 * deps: serve-static@~1.5.41360 - deps: send@0.8.5136113624.8.7 / 2014-08-291363==================13641365 * deps: qs@2.2.21366 - Remove unnecessary cloning136713684.8.6 / 2014-08-271369==================13701371 * deps: qs@2.2.01372 - Array parsing fix1373 - Performance improvements137413754.8.5 / 2014-08-181376==================13771378 * deps: send@0.8.31379 - deps: destroy@1.0.31380 - deps: on-finished@2.1.01381 * deps: serve-static@~1.5.31382 - deps: send@0.8.3138313844.8.4 / 2014-08-141385==================13861387 * deps: qs@1.2.21388 * deps: send@0.8.21389 - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`1390 * deps: serve-static@~1.5.21391 - deps: send@0.8.2139213934.8.3 / 2014-08-101394==================13951396 * deps: parseurl@~1.3.01397 * deps: qs@1.2.11398 * deps: serve-static@~1.5.11399 - Fix parsing of weird `req.originalUrl` values1400 - deps: parseurl@~1.3.01401 - deps: utils-merge@1.0.0140214034.8.2 / 2014-08-071404==================14051406 * deps: qs@1.2.01407 - Fix parsing array of objects140814094.8.1 / 2014-08-061410==================14111412 * fix incorrect deprecation warnings on `res.download`1413 * deps: qs@1.1.01414 - Accept urlencoded square brackets1415 - Accept empty values in implicit array notation141614174.8.0 / 2014-08-051418==================14191420 * add `res.sendFile`1421 - accepts a file system path instead of a URL1422 - requires an absolute path or `root` option specified1423 * deprecate `res.sendfile` -- use `res.sendFile` instead1424 * support mounted app as any argument to `app.use()`1425 * deps: qs@1.0.21426 - Complete rewrite1427 - Limits array length to 201428 - Limits object depth to 51429 - Limits parameters to 1,0001430 * deps: send@0.8.11431 - Add `extensions` option1432 * deps: serve-static@~1.5.01433 - Add `extensions` option1434 - deps: send@0.8.1143514364.7.4 / 2014-08-041437==================14381439 * fix `res.sendfile` regression for serving directory index files1440 * deps: send@0.7.41441 - Fix incorrect 403 on Windows and Node.js 0.111442 - Fix serving index files without root dir1443 * deps: serve-static@~1.4.41444 - deps: send@0.7.4144514464.7.3 / 2014-08-041447==================14481449 * deps: send@0.7.31450 - Fix incorrect 403 on Windows and Node.js 0.111451 * deps: serve-static@~1.4.31452 - Fix incorrect 403 on Windows and Node.js 0.111453 - deps: send@0.7.3145414554.7.2 / 2014-07-271456==================14571458 * deps: depd@0.4.41459 - Work-around v8 generating empty stack traces1460 * deps: send@0.7.21461 - deps: depd@0.4.41462 * deps: serve-static@~1.4.2146314644.7.1 / 2014-07-261465==================14661467 * deps: depd@0.4.31468 - Fix exception when global `Error.stackTraceLimit` is too low1469 * deps: send@0.7.11470 - deps: depd@0.4.31471 * deps: serve-static@~1.4.1147214734.7.0 / 2014-07-251474==================14751476 * fix `req.protocol` for proxy-direct connections1477 * configurable query parser with `app.set('query parser', parser)`1478 - `app.set('query parser', 'extended')` parse with "qs" module1479 - `app.set('query parser', 'simple')` parse with "querystring" core module1480 - `app.set('query parser', false)` disable query string parsing1481 - `app.set('query parser', true)` enable simple parsing1482 * deprecate `res.json(status, obj)` -- use `res.status(status).json(obj)` instead1483 * deprecate `res.jsonp(status, obj)` -- use `res.status(status).jsonp(obj)` instead1484 * deprecate `res.send(status, body)` -- use `res.status(status).send(body)` instead1485 * deps: debug@1.0.41486 * deps: depd@0.4.21487 - Add `TRACE_DEPRECATION` environment variable1488 - Remove non-standard grey color from color output1489 - Support `--no-deprecation` argument1490 - Support `--trace-deprecation` argument1491 * deps: finalhandler@0.1.01492 - Respond after request fully read1493 - deps: debug@1.0.41494 * deps: parseurl@~1.2.01495 - Cache URLs based on original value1496 - Remove no-longer-needed URL mis-parse work-around1497 - Simplify the "fast-path" `RegExp`1498 * deps: send@0.7.01499 - Add `dotfiles` option1500 - Cap `maxAge` value to 1 year1501 - deps: debug@1.0.41502 - deps: depd@0.4.21503 * deps: serve-static@~1.4.01504 - deps: parseurl@~1.2.01505 - deps: send@0.7.01506 * perf: prevent multiple `Buffer` creation in `res.send`150715084.6.1 / 2014-07-121509==================15101511 * fix `subapp.mountpath` regression for `app.use(subapp)`151215134.6.0 / 2014-07-111514==================15151516 * accept multiple callbacks to `app.use()`1517 * add explicit "Rosetta Flash JSONP abuse" protection1518 - previous versions are not vulnerable; this is just explicit protection1519 * catch errors in multiple `req.param(name, fn)` handlers1520 * deprecate `res.redirect(url, status)` -- use `res.redirect(status, url)` instead1521 * fix `res.send(status, num)` to send `num` as json (not error)1522 * remove unnecessary escaping when `res.jsonp` returns JSON response1523 * support non-string `path` in `app.use(path, fn)`1524 - supports array of paths1525 - supports `RegExp`1526 * router: fix optimization on router exit1527 * router: refactor location of `try` blocks1528 * router: speed up standard `app.use(fn)`1529 * deps: debug@1.0.31530 - Add support for multiple wildcards in namespaces1531 * deps: finalhandler@0.0.31532 - deps: debug@1.0.31533 * deps: methods@1.1.01534 - add `CONNECT`1535 * deps: parseurl@~1.1.31536 - faster parsing of href-only URLs1537 * deps: path-to-regexp@0.1.31538 * deps: send@0.6.01539 - deps: debug@1.0.31540 * deps: serve-static@~1.3.21541 - deps: parseurl@~1.1.31542 - deps: send@0.6.01543 * perf: fix arguments reassign deopt in some `res` methods154415454.5.1 / 2014-07-061546==================15471548 * fix routing regression when altering `req.method`154915504.5.0 / 2014-07-041551==================15521553 * add deprecation message to non-plural `req.accepts*`1554 * add deprecation message to `res.send(body, status)`1555 * add deprecation message to `res.vary()`1556 * add `headers` option to `res.sendfile`1557 - use to set headers on successful file transfer1558 * add `mergeParams` option to `Router`1559 - merges `req.params` from parent routes1560 * add `req.hostname` -- correct name for what `req.host` returns1561 * deprecate things with `depd` module1562 * deprecate `req.host` -- use `req.hostname` instead1563 * fix behavior when handling request without routes1564 * fix handling when `route.all` is only route1565 * invoke `router.param()` only when route matches1566 * restore `req.params` after invoking router1567 * use `finalhandler` for final response handling1568 * use `media-typer` to alter content-type charset1569 * deps: accepts@~1.0.71570 * deps: send@0.5.01571 - Accept string for `maxage` (converted by `ms`)1572 - Include link in default redirect response1573 * deps: serve-static@~1.3.01574 - Accept string for `maxAge` (converted by `ms`)1575 - Add `setHeaders` option1576 - Include HTML link in redirect response1577 - deps: send@0.5.01578 * deps: type-is@~1.3.2157915804.4.5 / 2014-06-261581==================15821583 * deps: cookie-signature@1.0.41584 - fix for timing attacks158515864.4.4 / 2014-06-201587==================15881589 * fix `res.attachment` Unicode filenames in Safari1590 * fix "trim prefix" debug message in `express:router`1591 * deps: accepts@~1.0.51592 * deps: buffer-crc32@0.2.3159315944.4.3 / 2014-06-111595==================15961597 * fix persistence of modified `req.params[name]` from `app.param()`1598 * deps: accepts@1.0.31599 - deps: negotiator@0.4.61600 * deps: debug@1.0.21601 * deps: send@0.4.31602 - Do not throw uncatchable error on file open race condition1603 - Use `escape-html` for HTML escaping1604 - deps: debug@1.0.21605 - deps: finished@1.2.21606 - deps: fresh@0.2.21607 * deps: serve-static@1.2.31608 - Do not throw uncatchable error on file open race condition1609 - deps: send@0.4.3161016114.4.2 / 2014-06-091612==================16131614 * fix catching errors from top-level handlers1615 * use `vary` module for `res.vary`1616 * deps: debug@1.0.11617 * deps: proxy-addr@1.0.11618 * deps: send@0.4.21619 - fix "event emitter leak" warnings1620 - deps: debug@1.0.11621 - deps: finished@1.2.11622 * deps: serve-static@1.2.21623 - fix "event emitter leak" warnings1624 - deps: send@0.4.21625 * deps: type-is@1.2.1162616274.4.1 / 2014-06-021628==================16291630 * deps: methods@1.0.11631 * deps: send@0.4.11632 - Send `max-age` in `Cache-Control` in correct format1633 * deps: serve-static@1.2.11634 - use `escape-html` for escaping1635 - deps: send@0.4.1163616374.4.0 / 2014-05-301638==================16391640 * custom etag control with `app.set('etag', val)`1641 - `app.set('etag', function(body, encoding){ return '"etag"' })` custom etag generation1642 - `app.set('etag', 'weak')` weak tag1643 - `app.set('etag', 'strong')` strong etag1644 - `app.set('etag', false)` turn off1645 - `app.set('etag', true)` standard etag1646 * mark `res.send` ETag as weak and reduce collisions1647 * update accepts to 1.0.21648 - Fix interpretation when header not in request1649 * update send to 0.4.01650 - Calculate ETag with md5 for reduced collisions1651 - Ignore stream errors after request ends1652 - deps: debug@0.8.11653 * update serve-static to 1.2.01654 - Calculate ETag with md5 for reduced collisions1655 - Ignore stream errors after request ends1656 - deps: send@0.4.0165716584.3.2 / 2014-05-281659==================16601661 * fix handling of errors from `router.param()` callbacks166216634.3.1 / 2014-05-231664==================16651666 * revert "fix behavior of multiple `app.VERB` for the same path"1667 - this caused a regression in the order of route execution166816694.3.0 / 2014-05-211670==================16711672 * add `req.baseUrl` to access the path stripped from `req.url` in routes1673 * fix behavior of multiple `app.VERB` for the same path1674 * fix issue routing requests among sub routers1675 * invoke `router.param()` only when necessary instead of every match1676 * proper proxy trust with `app.set('trust proxy', trust)`1677 - `app.set('trust proxy', 1)` trust first hop1678 - `app.set('trust proxy', 'loopback')` trust loopback addresses1679 - `app.set('trust proxy', '10.0.0.1')` trust single IP1680 - `app.set('trust proxy', '10.0.0.1/16')` trust subnet1681 - `app.set('trust proxy', '10.0.0.1, 10.0.0.2')` trust list1682 - `app.set('trust proxy', false)` turn off1683 - `app.set('trust proxy', true)` trust everything1684 * set proper `charset` in `Content-Type` for `res.send`1685 * update type-is to 1.2.01686 - support suffix matching168716884.2.0 / 2014-05-111689==================16901691 * deprecate `app.del()` -- use `app.delete()` instead1692 * deprecate `res.json(obj, status)` -- use `res.json(status, obj)` instead1693 - the edge-case `res.json(status, num)` requires `res.status(status).json(num)`1694 * deprecate `res.jsonp(obj, status)` -- use `res.jsonp(status, obj)` instead1695 - the edge-case `res.jsonp(status, num)` requires `res.status(status).jsonp(num)`1696 * fix `req.next` when inside router instance1697 * include `ETag` header in `HEAD` requests1698 * keep previous `Content-Type` for `res.jsonp`1699 * support PURGE method1700 - add `app.purge`1701 - add `router.purge`1702 - include PURGE in `app.all`1703 * update debug to 0.8.01704 - add `enable()` method1705 - change from stderr to stdout1706 * update methods to 1.0.01707 - add PURGE170817094.1.2 / 2014-05-081710==================17111712 * fix `req.host` for IPv6 literals1713 * fix `res.jsonp` error if callback param is object171417154.1.1 / 2014-04-271716==================17171718 * fix package.json to reflect supported node version171917204.1.0 / 2014-04-241721==================17221723 * pass options from `res.sendfile` to `send`1724 * preserve casing of headers in `res.header` and `res.set`1725 * support unicode file names in `res.attachment` and `res.download`1726 * update accepts to 1.0.11727 - deps: negotiator@0.4.01728 * update cookie to 0.1.21729 - Fix for maxAge == 01730 - made compat with expires field1731 * update send to 0.3.01732 - Accept API options in options object1733 - Coerce option types1734 - Control whether to generate etags1735 - Default directory access to 403 when index disabled1736 - Fix sending files with dots without root set1737 - Include file path in etag1738 - Make "Can't set headers after they are sent." catchable1739 - Send full entity-body for multi range requests1740 - Set etags to "weak"1741 - Support "If-Range" header1742 - Support multiple index paths1743 - deps: mime@1.2.111744 * update serve-static to 1.1.01745 - Accept options directly to `send` module1746 - Resolve relative paths at middleware setup1747 - Use parseurl to parse the URL from request1748 - deps: send@0.3.01749 * update type-is to 1.1.01750 - add non-array values support1751 - add `multipart` as a shorthand175217534.0.0 / 2014-04-091754==================17551756 * remove:1757 - node 0.8 support1758 - connect and connect's patches except for charset handling1759 - express(1) - moved to [express-generator](https://github.com/expressjs/generator)1760 - `express.createServer()` - it has been deprecated for a long time. Use `express()`1761 - `app.configure` - use logic in your own app code1762 - `app.router` - is removed1763 - `req.auth` - use `basic-auth` instead1764 - `req.accepted*` - use `req.accepts*()` instead1765 - `res.location` - relative URL resolution is removed1766 - `res.charset` - include the charset in the content type when using `res.set()`1767 - all bundled middleware except `static`1768 * change:1769 - `app.route` -> `app.mountpath` when mounting an express app in another express app1770 - `json spaces` no longer enabled by default in development1771 - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`1772 - `req.params` is now an object instead of an array1773 - `res.locals` is no longer a function. It is a plain js object. Treat it as such.1774 - `res.headerSent` -> `res.headersSent` to match node.js ServerResponse object1775 * refactor:1776 - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)1777 - `req.is` with [type-is](https://github.com/expressjs/type-is)1778 - [path-to-regexp](https://github.com/component/path-to-regexp)1779 * add:1780 - `app.router()` - returns the app Router instance1781 - `app.route()` - Proxy to the app's `Router#route()` method to create a new route1782 - Router & Route - public API178317843.21.2 / 2015-07-311785===================17861787 * deps: connect@2.30.21788 - deps: body-parser@~1.13.31789 - deps: compression@~1.5.21790 - deps: errorhandler@~1.4.21791 - deps: method-override@~2.3.51792 - deps: serve-index@~1.7.21793 - deps: type-is@~1.6.61794 - deps: vhost@~3.0.11795 * deps: vary@~1.0.11796 - Fix setting empty header from empty `field`1797 - perf: enable strict mode1798 - perf: remove argument reassignments179918003.21.1 / 2015-07-051801===================18021803 * deps: basic-auth@~1.0.31804 * deps: connect@2.30.11805 - deps: body-parser@~1.13.21806 - deps: compression@~1.5.11807 - deps: errorhandler@~1.4.11808 - deps: morgan@~1.6.11809 - deps: pause@0.1.01810 - deps: qs@4.0.01811 - deps: serve-index@~1.7.11812 - deps: type-is@~1.6.4181318143.21.0 / 2015-06-181815===================18161817 * deps: basic-auth@1.0.21818 - perf: enable strict mode1819 - perf: hoist regular expression1820 - perf: parse with regular expressions1821 - perf: remove argument reassignment1822 * deps: connect@2.30.01823 - deps: body-parser@~1.13.11824 - deps: bytes@2.1.01825 - deps: compression@~1.5.01826 - deps: cookie@0.1.31827 - deps: cookie-parser@~1.3.51828 - deps: csurf@~1.8.31829 - deps: errorhandler@~1.4.01830 - deps: express-session@~1.11.31831 - deps: finalhandler@0.4.01832 - deps: fresh@0.3.01833 - deps: morgan@~1.6.01834 - deps: serve-favicon@~2.3.01835 - deps: serve-index@~1.7.01836 - deps: serve-static@~1.10.01837 - deps: type-is@~1.6.31838 * deps: cookie@0.1.31839 - perf: deduce the scope of try-catch deopt1840 - perf: remove argument reassignments1841 * deps: escape-html@1.0.21842 * deps: etag@~1.7.01843 - Always include entity length in ETags for hash length extensions1844 - Generate non-Stats ETags using MD5 only (no longer CRC32)1845 - Improve stat performance by removing hashing1846 - Improve support for JXcore1847 - Remove base64 padding in ETags to shorten1848 - Support "fake" stats objects in environments without fs1849 - Use MD5 instead of MD4 in weak ETags over 1KB1850 * deps: fresh@0.3.01851 - Add weak `ETag` matching support1852 * deps: mkdirp@0.5.11853 - Work in global strict mode1854 * deps: send@0.13.01855 - Allow Node.js HTTP server to set `Date` response header1856 - Fix incorrectly removing `Content-Location` on 304 response1857 - Improve the default redirect response headers1858 - Send appropriate headers on default error response1859 - Use `http-errors` for standard emitted errors1860 - Use `statuses` instead of `http` module for status messages1861 - deps: escape-html@1.0.21862 - deps: etag@~1.7.01863 - deps: fresh@0.3.01864 - deps: on-finished@~2.3.01865 - perf: enable strict mode1866 - perf: remove unnecessary array allocations186718683.20.3 / 2015-05-171869===================18701871 * deps: connect@2.29.21872 - deps: body-parser@~1.12.41873 - deps: compression@~1.4.41874 - deps: connect-timeout@~1.6.21875 - deps: debug@~2.2.01876 - deps: depd@~1.0.11877 - deps: errorhandler@~1.3.61878 - deps: finalhandler@0.3.61879 - deps: method-override@~2.3.31880 - deps: morgan@~1.5.31881 - deps: qs@2.4.21882 - deps: response-time@~2.3.11883 - deps: serve-favicon@~2.2.11884 - deps: serve-index@~1.6.41885 - deps: serve-static@~1.9.31886 - deps: type-is@~1.6.21887 * deps: debug@~2.2.01888 - deps: ms@0.7.11889 * deps: depd@~1.0.11890 * deps: proxy-addr@~1.0.81891 - deps: ipaddr.js@1.0.11892 * deps: send@0.12.31893 - deps: debug@~2.2.01894 - deps: depd@~1.0.11895 - deps: etag@~1.6.01896 - deps: ms@0.7.11897 - deps: on-finished@~2.2.1189818993.20.2 / 2015-03-161900===================19011902 * deps: connect@2.29.11903 - deps: body-parser@~1.12.21904 - deps: compression@~1.4.31905 - deps: connect-timeout@~1.6.11906 - deps: debug@~2.1.31907 - deps: errorhandler@~1.3.51908 - deps: express-session@~1.10.41909 - deps: finalhandler@0.3.41910 - deps: method-override@~2.3.21911 - deps: morgan@~1.5.21912 - deps: qs@2.4.11913 - deps: serve-index@~1.6.31914 - deps: serve-static@~1.9.21915 - deps: type-is@~1.6.11916 * deps: debug@~2.1.31917 - Fix high intensity foreground color for bold1918 - deps: ms@0.7.01919 * deps: merge-descriptors@1.0.01920 * deps: proxy-addr@~1.0.71921 - deps: ipaddr.js@0.1.91922 * deps: send@0.12.21923 - Throw errors early for invalid `extensions` or `index` options1924 - deps: debug@~2.1.3192519263.20.1 / 2015-02-281927===================19281929 * Fix `req.host` when using "trust proxy" hops count1930 * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count193119323.20.0 / 2015-02-181933===================19341935 * Fix `"trust proxy"` setting to inherit when app is mounted1936 * Generate `ETag`s for all request responses1937 - No longer restricted to only responses for `GET` and `HEAD` requests1938 * Use `content-type` to parse `Content-Type` headers1939 * deps: connect@2.29.01940 - Use `content-type` to parse `Content-Type` headers1941 - deps: body-parser@~1.12.01942 - deps: compression@~1.4.11943 - deps: connect-timeout@~1.6.01944 - deps: cookie-parser@~1.3.41945 - deps: cookie-signature@1.0.61946 - deps: csurf@~1.7.01947 - deps: errorhandler@~1.3.41948 - deps: express-session@~1.10.31949 - deps: http-errors@~1.3.11950 - deps: response-time@~2.3.01951 - deps: serve-index@~1.6.21952 - deps: serve-static@~1.9.11953 - deps: type-is@~1.6.01954 * deps: cookie-signature@1.0.61955 * deps: send@0.12.11956 - Always read the stat size from the file1957 - Fix mutating passed-in `options`1958 - deps: mime@1.3.4195919603.19.2 / 2015-02-011961===================19621963 * deps: connect@2.28.31964 - deps: compression@~1.3.11965 - deps: csurf@~1.6.61966 - deps: errorhandler@~1.3.31967 - deps: express-session@~1.10.21968 - deps: serve-index@~1.6.11969 - deps: type-is@~1.5.61970 * deps: proxy-addr@~1.0.61971 - deps: ipaddr.js@0.1.8197219733.19.1 / 2015-01-201974===================19751976 * deps: connect@2.28.21977 - deps: body-parser@~1.10.21978 - deps: serve-static@~1.8.11979 * deps: send@0.11.11980 - Fix root path disclosure198119823.19.0 / 2015-01-091983===================19841985 * Fix `OPTIONS` responses to include the `HEAD` method property1986 * Use `readline` for prompt in `express(1)`1987 * deps: commander@2.6.01988 * deps: connect@2.28.11989 - deps: body-parser@~1.10.11990 - deps: compression@~1.3.01991 - deps: connect-timeout@~1.5.01992 - deps: csurf@~1.6.41993 - deps: debug@~2.1.11994 - deps: errorhandler@~1.3.21995 - deps: express-session@~1.10.11996 - deps: finalhandler@0.3.31997 - deps: method-override@~2.3.11998 - deps: morgan@~1.5.11999 - deps: serve-favicon@~2.2.02000 - deps: serve-index@~1.6.0
Findings
✓ No findings reported for this file.