15.3.02=====34## 🐞 Bug fixes56- Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by [@YuryShkoda](https://github.com/YuryShkoda) in [#4893](https://github.com/expressjs/express/pull/4893)789    Fixed the behavior of `res.send()` to prevent conflicts between `Content-Length` and `Transfer-Encoding` HTTP headers in responses. The `Content-Length` header in `res.send()` is now only added when a `Transfer-Encoding` header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a `Transfer-Encoding` header - by [@cuishuang](https://github.com/cuishuang) in [#7459](https://github.com/expressjs/express/pull/7459)1011* Upgrade `qs` to `^6.16.0`, which fixes [CVE-2026-2391](https://www.cve.org/CVERecord?id=CVE-2026-2391) ([GHSA-w7fw-mjwx-w883](https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883)), [CVE-2026-82417](https://www.cve.org/CVERecord?id=CVE-2026-82417) ([GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g)) and [CVE-2026-82562](https://www.cve.org/CVERecord?id=CVE-2026-82562) ([GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)): `arrayLimit` bypasses in comma parsing and a denial of service via an attacker-controlled `isBuffer` - by [@davetashner](https://github.com/davetashner) in [#7057](https://github.com/expressjs/express/pull/7057) and [#7478](https://github.com/expressjs/express/pull/7478), and [@cyphercodes](https://github.com/cyphercodes) in [#7305](https://github.com/expressjs/express/pull/7305)1213* Upgrade `proxy-addr` to `^2.0.8`, which fixes [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) - by [@lazerg](https://github.com/lazerg) in [#7474](https://github.com/expressjs/express/pull/7474)1415## 🚀 Improvements1617* Allow conditional revalidation for QUERY requests. `req.fresh` previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by [@Cherry](https://github.com/Cherry) in [#7366](https://github.com/expressjs/express/pull/7366)1819    ```js20    // QUERY /reports with If-None-Match: "12345"21    app.query('/reports', (req, res) => {22      res.set('ETag', '"12345"');23      res.send(results); // now responds 304 Not Modified24    });25    ```2627* Improve HTML structure in `res.redirect()` responses when HTML format is accepted by adding `<!DOCTYPE html>`, `<title>`, and `<body>` tags for better browser compatibility - by [@Bernice55231](https://github.com/Bernice55231) in [#5167](https://github.com/expressjs/express/pull/5167)2829* When calling `app.render` with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by [AkaHarshit](https://github.com/AkaHarshit) in [#6903](https://github.com/expressjs/express/pull/6903)3031    ```js32    app.render('index', null, callback); // now works as expected33    ```3435* Upgrade `content-type` to `^2.0.0`, bringing a faster parser (~1.5x quicker `Content-Type` parsing/formatting in `res.send()`) along with a behavior change: `res.send()` now keeps any existing parameters when adding the charset and no longer throws on a `Content-Type` that fails to parse. `type-is` is upgraded to `^2.1.0` as part of the same change - by [@blakeembrey](https://github.com/blakeembrey) in [#7234](https://github.com/expressjs/express/pull/7234)3637    ```js38    res.set('Content-Type', 'text/plain; foo=bar').send('hey');39    // -> Content-Type: text/plain; foo=bar; charset=utf-840    ```4142* The default error handler now logs the full error object instead of only its stack trace, so nested details such as `Error.cause` and library-specific properties (e.g. Sequelize's `parent`/`original`) are no longer swallowed - by [@Nitin-Mohapatra](https://github.com/Nitin-Mohapatra) in [#6464](https://github.com/expressjs/express/pull/6464)4344* Upgrade `content-disposition` to `^2.0.1`, which changes the `Content-Disposition` header emitted by `res.download()`, `res.attachment()`, and `res.sendFile()`: file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by [@blakeembrey](https://github.com/blakeembrey) in [#7233](https://github.com/expressjs/express/pull/7233)4546    ```js47    res.attachment('user.html');48    // before -> Content-Disposition: attachment; filename="user.html"49    // after  -> Content-Disposition: attachment; filename=user.html50    ```5152* Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored - by [@Mayvis](https://github.com/Mayvis) in [#7390](https://github.com/expressjs/express/pull/7390)5354## ⚡ Performance5556* Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@bjohansebas](https://github.com/bjohansebas) in [#6991](https://github.com/expressjs/express/pull/6991)57585.2.159=====6061* Revert security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))62  * The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.63645.2.065=====6667* Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))68* deps: `body-parser@^2.2.1`69* A deprecation warning was added when using `res.redirect` with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.70715.1.072=====7374* Add support for `Uint8Array` in `res.send()`75* Add support for ETag option in `res.sendFile()`76* Add support for multiple links with the same rel in `res.links()`77* Add funding field to package.json78* perf: use loop for acceptParams79* refactor: prefix built-in node module imports80* deps: remove `setprototypeof`81* deps: remove `safe-buffer`82* deps: remove `utils-merge`83* deps: remove `methods`84* deps: remove `depd`85* deps: `debug@^4.4.0`86* deps: `body-parser@^2.2.0`87* deps: `router@^2.2.0`88* deps: `content-type@^1.0.5`89* deps: `finalhandler@^2.1.0`90* deps: `qs@^6.14.0`91* deps: `server-static@2.2.0`92* deps: `type-is@2.0.1`93945.0.195=====9697* Update `cookie` semver lock to address [CVE-2024-47764](https://nvd.nist.gov/vuln/detail/CVE-2024-47764)98995.0.0100=====101* remove:102  - `path-is-absolute` dependency - use `path.isAbsolute` instead103* breaking:104  * `res.status()` accepts only integers, and input must be greater than 99 and less than 1000105    * will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range106    * will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs107  * deps: send@1.0.0108  * `res.redirect('back')` and `res.location('back')` is no longer a supported magic string, explicitly use `req.get('Referrer') || '/'`.109* change:110  - `res.clearCookie` will ignore user provided `maxAge` and `expires` options111* deps: cookie-signature@^1.2.1112* deps: debug@4.3.6113* deps: merge-descriptors@^2.0.0114* deps: serve-static@^2.1.0115* deps: qs@6.13.0116* deps: accepts@^2.0.0117* deps: mime-types@^3.0.0118  - `application/javascript` => `text/javascript`119* deps: type-is@^2.0.0120* deps: content-disposition@^1.0.0121* deps: finalhandler@^2.0.0122* deps: fresh@^2.0.0123* deps: body-parser@^2.0.1124* deps: send@^1.1.01251265.0.0-beta.3127============128129This incorporates all changes after 4.19.1 up to 4.19.2.1301315.0.0-beta.2132============133134This incorporates all changes after 4.17.2 up to 4.19.1.1351365.0.0-beta.1137============138139This is the first Express 5.0 beta release, based off 4.17.2 and includes140changes from 5.0.0-alpha.8.141142  * change:143    - Default "query parser" setting to `'simple'`144    - Requires Node.js 4+145    - Use `mime-types` for file to content type mapping146  * deps: array-flatten@3.0.0147  * deps: body-parser@2.0.0-beta.1148    - `req.body` is no longer always initialized to `{}`149    - `urlencoded` parser now defaults `extended` to `false`150    - Use `on-finished` to determine when body read151  * deps: router@2.0.0-beta.1152    - Add new `?`, `*`, and `+` parameter modifiers153    - Internalize private `router.process_params` method154    - Matching group expressions are only RegExp syntax155    - Named matching groups no longer available by position in `req.params`156    - Regular expressions can only be used in a matching group157    - Remove `debug` dependency158    - Special `*` path segment behavior removed159    - deps: array-flatten@3.0.0160    - deps: parseurl@~1.3.3161    - deps: path-to-regexp@3.2.0162    - deps: setprototypeof@1.2.0163  * deps: send@1.0.0-beta.1164    - Change `dotfiles` option default to `'ignore'`165    - Remove `hidden` option; use `dotfiles` option instead166    - Use `mime-types` for file to content type mapping167    - deps: debug@3.1.0168  * deps: serve-static@2.0.0-beta.1169    - Change `dotfiles` option default to `'ignore'`170    - Remove `hidden` option; use `dotfiles` option instead171    - Use `mime-types` for file to content type mapping172    - Remove `express.static.mime` export; use `mime-types` package instead173    - deps: send@1.0.0-beta.11741755.0.0-alpha.8176=============177178This is the eighth Express 5.0 alpha release, based off 4.17.1 and includes179changes from 5.0.0-alpha.7.1801815.0.0-alpha.7182=============183184This is the seventh Express 5.0 alpha release, based off 4.16.4 and includes185changes from 5.0.0-alpha.6.186187The major change with this alpha is the basic support for returned, rejected188Promises in the router.189190  * remove:191    - `path-to-regexp` dependency192  * deps: debug@3.1.0193    - Add `DEBUG_HIDE_DATE` environment variable194    - Change timer to per-namespace instead of global195    - Change non-TTY date format196    - Remove `DEBUG_FD` environment variable support197    - Support 256 namespace colors198  * deps: router@2.0.0-alpha.1199    - Add basic support for returned, rejected Promises200    - Fix JSDoc for `Router` constructor201    - deps: debug@3.1.0202    - deps: parseurl@~1.3.2203    - deps: setprototypeof@1.1.0204    - deps: utils-merge@1.0.12052065.0.0-alpha.6207=============208209This is the sixth Express 5.0 alpha release, based off 4.15.5 and includes210changes from 5.0.0-alpha.5.211212  * remove:213    - `res.redirect(url, status)` signature - use `res.redirect(status, url)`214    - `res.send(status, body)` signature - use `res.status(status).send(body)`215  * deps: router@~1.3.1216    - deps: debug@2.6.82172185.0.0-alpha.5219=============220221This is the fifth Express 5.0 alpha release, based off 4.15.2 and includes222changes from 5.0.0-alpha.4.2232245.0.0-alpha.4225=============226227This is the fourth Express 5.0 alpha release, based off 4.15.0 and includes228changes from 5.0.0-alpha.3.229230  * remove:231    - Remove Express 3.x middleware error stubs232  * deps: router@~1.3.0233    - Add `next("router")` to exit from router234    - Fix case where `router.use` skipped requests routes did not235    - Skip routing when `req.url` is not set236    - Use `%o` in path debug to tell types apart237    - deps: debug@2.6.1238    - deps: setprototypeof@1.0.3239    - perf: add fast match path for `*` route2402415.0.0-alpha.3242=============243244This is the third Express 5.0 alpha release, based off 4.14.1 and includes245changes from 5.0.0-alpha.2.246247  * remove:248    - `res.json(status, obj)` signature - use `res.status(status).json(obj)`249    - `res.jsonp(status, obj)` signature - use `res.status(status).jsonp(obj)`250    - `res.vary()` (no arguments) -- provide a field name as an argument251  * deps: array-flatten@2.1.1252  * deps: path-is-absolute@1.0.1253  * deps: router@~1.1.5254    - deps: array-flatten@2.0.1255    - deps: methods@~1.1.2256    - deps: parseurl@~1.3.1257    - deps: setprototypeof@1.0.22582595.0.0-alpha.2260=============261262This is the second Express 5.0 alpha release, based off 4.13.1 and includes263changes from 5.0.0-alpha.1.264265  * remove:266    - `app.param(fn)`267    - `req.param()` -- use `req.params`, `req.body`, or `req.query` instead268  * change:269    - `res.render` callback is always async, even for sync view engines270    - The leading `:` character in `name` for `app.param(name, fn)` is no longer removed271    - Use `router` module for routing272    - Use `path-is-absolute` module for absolute path detection2732745.0.0-alpha.1275=============276277This is the first Express 5.0 alpha release, based off 4.10.1.278279  * remove:280    - `app.del` - use `app.delete`281    - `req.acceptsCharset` - use `req.acceptsCharsets`282    - `req.acceptsEncoding` - use `req.acceptsEncodings`283    - `req.acceptsLanguage` - use `req.acceptsLanguages`284    - `res.json(obj, status)` signature - use `res.json(status, obj)`285    - `res.jsonp(obj, status)` signature - use `res.jsonp(status, obj)`286    - `res.send(body, status)` signature - use `res.send(status, body)`287    - `res.send(status)` signature - use `res.sendStatus(status)`288    - `res.sendfile` - use `res.sendFile` instead289    - `express.query` middleware290  * change:291    - `req.host` now returns host (`hostname:port`) - use `req.hostname` for only hostname292    - `req.query` is now a getter instead of a plain property293  * add:294    - `app.router` is a reference to the base router2952964.20.0297======298  * deps: serve-static@0.16.0299    * Remove link renderization in html while redirecting300  * deps: send@0.19.0301    * Remove link renderization in html while redirecting302  * deps: body-parser@0.6.0303    * add `depth` option to customize the depth level in the parser304    * IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`)305  * Remove link renderization in html while using `res.redirect`306  * deps: path-to-regexp@0.1.10307    - Adds support for named matching groups in the routes using a regex308    - Adds backtracking protection to parameters without regexes defined309  * deps: encodeurl@~2.0.0310    - Removes encoding of `\`, `|`, and `^` to align better with URL spec311  * Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie`312    - Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie3133144.19.2315======316317  * Improved fix for open redirect allow list bypass3183194.19.1320======321322  * Allow passing non-strings to res.location with new encoding handling checks3233244.19.0325======326327  * Prevent open redirect allow list bypass due to encodeurl328  * deps: cookie@0.6.03293304.18.3331======332333  * Fix routing requests without method334  * deps: body-parser@1.20.2335    - Fix strict json error message on Node.js 19+336    - deps: content-type@~1.0.5337    - deps: raw-body@2.5.2338  * deps: cookie@0.6.0339    - Add `partitioned` option3403414.18.2342======343344  * Fix regression routing a large stack in a single route345  * deps: body-parser@1.20.1346    - deps: qs@6.11.0347    - perf: remove unnecessary object clone348  * deps: qs@6.11.03493504.18.1351======352353  * Fix hanging on large stack of sync routes3543554.18.0356======357358  * Add "root" option to `res.download`359  * Allow `options` without `filename` in `res.download`360  * Deprecate string and non-integer arguments to `res.status`361  * Fix behavior of `null`/`undefined` as `maxAge` in `res.cookie`362  * Fix handling very large stacks of sync middleware363  * Ignore `Object.prototype` values in settings through `app.set`/`app.get`364  * Invoke `default` with same arguments as types in `res.format`365  * Support proper 205 responses using `res.send`366  * Use `http-errors` for `res.format` error367  * deps: body-parser@1.20.0368    - Fix error message for json parse whitespace in `strict`369    - Fix internal error when inflated body exceeds limit370    - Prevent loss of async hooks context371    - Prevent hanging when request already read372    - deps: depd@2.0.0373    - deps: http-errors@2.0.0374    - deps: on-finished@2.4.1375    - deps: qs@6.10.3376    - deps: raw-body@2.5.1377  * deps: cookie@0.5.0378    - Add `priority` option379    - Fix `expires` option to reject invalid dates380  * deps: depd@2.0.0381    - Replace internal `eval` usage with `Function` constructor382    - Use instance methods on `process` to check for listeners383  * deps: finalhandler@1.2.0384    - Remove set content headers that break response385    - deps: on-finished@2.4.1386    - deps: statuses@2.0.1387  * deps: on-finished@2.4.1388    - Prevent loss of async hooks context389  * deps: qs@6.10.3390  * deps: send@0.18.0391    - Fix emitted 416 error missing headers property392    - Limit the headers removed for 304 response393    - deps: depd@2.0.0394    - deps: destroy@1.2.0395    - deps: http-errors@2.0.0396    - deps: on-finished@2.4.1397    - deps: statuses@2.0.1398  * deps: serve-static@1.15.0399    - deps: send@0.18.0400  * deps: statuses@2.0.1401    - Remove code 306402    - Rename `425 Unordered Collection` to standard `425 Too Early`4034044.17.3405======406407  * deps: accepts@~1.3.8408    - deps: mime-types@~2.1.34409    - deps: negotiator@0.6.3410  * deps: body-parser@1.19.2411    - deps: bytes@3.1.2412    - deps: qs@6.9.7413    - deps: raw-body@2.4.3414  * deps: cookie@0.4.2415  * deps: qs@6.9.7416    * Fix handling of `__proto__` keys417  * pref: remove unnecessary regexp for trust proxy4184194.17.2420======421422  * Fix handling of `undefined` in `res.jsonp`423  * Fix handling of `undefined` when `"json escape"` is enabled424  * Fix incorrect middleware execution with unanchored `RegExp`s425  * Fix `res.jsonp(obj, status)` deprecation message426  * Fix typo in `res.is` JSDoc427  * deps: body-parser@1.19.1428    - deps: bytes@3.1.1429    - deps: http-errors@1.8.1430    - deps: qs@6.9.6431    - deps: raw-body@2.4.2432    - deps: safe-buffer@5.2.1433    - deps: type-is@~1.6.18434  * deps: content-disposition@0.5.4435    - deps: safe-buffer@5.2.1436  * deps: cookie@0.4.1437    - Fix `maxAge` option to reject invalid values438  * deps: proxy-addr@~2.0.7439    - Use `req.socket` over deprecated `req.connection`440    - deps: forwarded@0.2.0441    - deps: ipaddr.js@1.9.1442  * deps: qs@6.9.6443  * deps: safe-buffer@5.2.1444  * deps: send@0.17.2445    - deps: http-errors@1.8.1446    - deps: ms@2.1.3447    - pref: ignore empty http tokens448  * deps: serve-static@1.14.2449    - deps: send@0.17.2450  * deps: setprototypeof@1.2.04514524.17.1453======454455  * Revert "Improve error message for `null`/`undefined` to `res.status`"4564574.17.0458======459460  * Add `express.raw` to parse bodies into `Buffer`461  * Add `express.text` to parse bodies into string462  * Improve error message for non-strings to `res.sendFile`463  * Improve error message for `null`/`undefined` to `res.status`464  * Support multiple hosts in `X-Forwarded-Host`465  * deps: accepts@~1.3.7466  * deps: body-parser@1.19.0467    - Add encoding MIK468    - Add petabyte (`pb`) support469    - Fix parsing array brackets after index470    - deps: bytes@3.1.0471    - deps: http-errors@1.7.2472    - deps: iconv-lite@0.4.24473    - deps: qs@6.7.0474    - deps: raw-body@2.4.0475    - deps: type-is@~1.6.17476  * deps: content-disposition@0.5.3477  * deps: cookie@0.4.0478    - Add `SameSite=None` support479  * deps: finalhandler@~1.1.2480    - Set stricter `Content-Security-Policy` header481    - deps: parseurl@~1.3.3482    - deps: statuses@~1.5.0483  * deps: parseurl@~1.3.3484  * deps: proxy-addr@~2.0.5485    - deps: ipaddr.js@1.9.0486  * deps: qs@6.7.0487    - Fix parsing array brackets after index488  * deps: range-parser@~1.2.1489  * deps: send@0.17.1490    - Set stricter CSP header in redirect & error responses491    - deps: http-errors@~1.7.2492    - deps: mime@1.6.0493    - deps: ms@2.1.1494    - deps: range-parser@~1.2.1495    - deps: statuses@~1.5.0496    - perf: remove redundant `path.normalize` call497  * deps: serve-static@1.14.1498    - Set stricter CSP header in redirect response499    - deps: parseurl@~1.3.3500    - deps: send@0.17.1501  * deps: setprototypeof@1.1.1502  * deps: statuses@~1.5.0503    - Add `103 Early Hints`504  * deps: type-is@~1.6.18505    - deps: mime-types@~2.1.24506    - perf: prevent internal `throw` on invalid type5075084.16.4509======510511  * Fix issue where `"Request aborted"` may be logged in `res.sendfile`512  * Fix JSDoc for `Router` constructor513  * deps: body-parser@1.18.3514    - Fix deprecation warnings on Node.js 10+515    - Fix stack trace for strict json parse error516    - deps: depd@~1.1.2517    - deps: http-errors@~1.6.3518    - deps: iconv-lite@0.4.23519    - deps: qs@6.5.2520    - deps: raw-body@2.3.3521    - deps: type-is@~1.6.16522  * deps: proxy-addr@~2.0.4523    - deps: ipaddr.js@1.8.0524  * deps: qs@6.5.2525  * deps: safe-buffer@5.1.25265274.16.3528======529530  * deps: accepts@~1.3.5531    - deps: mime-types@~2.1.18532  * deps: depd@~1.1.2533    - perf: remove argument reassignment534  * deps: encodeurl@~1.0.2535    - Fix encoding `%` as last character536  * deps: finalhandler@1.1.1537    - Fix 404 output for bad / missing pathnames538    - deps: encodeurl@~1.0.2539    - deps: statuses@~1.4.0540  * deps: proxy-addr@~2.0.3541    - deps: ipaddr.js@1.6.0542  * deps: send@0.16.2543    - Fix incorrect end tag in default error & redirects544    - deps: depd@~1.1.2545    - deps: encodeurl@~1.0.2546    - deps: statuses@~1.4.0547  * deps: serve-static@1.13.2548    - Fix incorrect end tag in redirects549    - deps: encodeurl@~1.0.2550    - deps: send@0.16.2551  * deps: statuses@~1.4.0552  * deps: type-is@~1.6.16553    - deps: mime-types@~2.1.185545554.16.2556======557558  * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set559  * perf: skip parsing of entire `X-Forwarded-Proto` header5605614.16.1562======563564  * deps: send@0.16.1565  * deps: serve-static@1.13.1566    - Fix regression when `root` is incorrectly set to a file567    - deps: send@0.16.15685694.16.0570======571572  * Add `"json escape"` setting for `res.json` and `res.jsonp`573  * Add `express.json` and `express.urlencoded` to parse bodies574  * Add `options` argument to `res.download`575  * Improve error message when autoloading invalid view engine576  * Improve error messages when non-function provided as middleware577  * Skip `Buffer` encoding when not generating ETag for small response578  * Use `safe-buffer` for improved Buffer API579  * deps: accepts@~1.3.4580    - deps: mime-types@~2.1.16581  * deps: content-type@~1.0.4582    - perf: remove argument reassignment583    - perf: skip parameter parsing when no parameters584  * deps: etag@~1.8.1585    - perf: replace regular expression with substring586  * deps: finalhandler@1.1.0587    - Use `res.headersSent` when available588  * deps: parseurl@~1.3.2589    - perf: reduce overhead for full URLs590    - perf: unroll the "fast-path" `RegExp`591  * deps: proxy-addr@~2.0.2592    - Fix trimming leading / trailing OWS in `X-Forwarded-For`593    - deps: forwarded@~0.1.2594    - deps: ipaddr.js@1.5.2595    - perf: reduce overhead when no `X-Forwarded-For` header596  * deps: qs@6.5.1597    - Fix parsing & compacting very deep objects598  * deps: send@0.16.0599    - Add 70 new types for file extensions600    - Add `immutable` option601    - Fix missing `</html>` in default error & redirects602    - Set charset as "UTF-8" for .js and .json603    - Use instance methods on steam to check for listeners604    - deps: mime@1.4.1605    - perf: improve path validation speed606  * deps: serve-static@1.13.0607    - Add 70 new types for file extensions608    - Add `immutable` option609    - Set charset as "UTF-8" for .js and .json610    - deps: send@0.16.0611  * deps: setprototypeof@1.1.0612  * deps: utils-merge@1.0.1613  * deps: vary@~1.1.2614    - perf: improve header token parsing speed615  * perf: reuse options object when generating ETags616  * perf: remove dead `.charset` set in `res.jsonp`6176184.15.5619======620621  * deps: debug@2.6.9622  * deps: finalhandler@~1.0.6623    - deps: debug@2.6.9624    - deps: parseurl@~1.3.2625  * deps: fresh@0.5.2626    - Fix handling of modified headers with invalid dates627    - perf: improve ETag match loop628    - perf: improve `If-None-Match` token parsing629  * deps: send@0.15.6630    - Fix handling of modified headers with invalid dates631    - deps: debug@2.6.9632    - deps: etag@~1.8.1633    - deps: fresh@0.5.2634    - perf: improve `If-Match` token parsing635  * deps: serve-static@1.12.6636    - deps: parseurl@~1.3.2637    - deps: send@0.15.6638    - perf: improve slash collapsing6396404.15.4641======642643  * deps: debug@2.6.8644  * deps: depd@~1.1.1645    - Remove unnecessary `Buffer` loading646  * deps: finalhandler@~1.0.4647    - deps: debug@2.6.8648  * deps: proxy-addr@~1.1.5649    - Fix array argument being altered650    - deps: ipaddr.js@1.4.0651  * deps: qs@6.5.0652  * deps: send@0.15.4653    - deps: debug@2.6.8654    - deps: depd@~1.1.1655    - deps: http-errors@~1.6.2656  * deps: serve-static@1.12.4657    - deps: send@0.15.46586594.15.3660======661662  * Fix error when `res.set` cannot add charset to `Content-Type`663  * deps: debug@2.6.7664    - Fix `DEBUG_MAX_ARRAY_LENGTH`665    - deps: ms@2.0.0666  * deps: finalhandler@~1.0.3667    - Fix missing `</html>` in HTML document668    - deps: debug@2.6.7669  * deps: proxy-addr@~1.1.4670    - deps: ipaddr.js@1.3.0671  * deps: send@0.15.3672    - deps: debug@2.6.7673    - deps: ms@2.0.0674  * deps: serve-static@1.12.3675    - deps: send@0.15.3676  * deps: type-is@~1.6.15677    - deps: mime-types@~2.1.15678  * deps: vary@~1.1.1679    - perf: hoist regular expression6806814.15.2682======683684  * deps: qs@6.4.0685    - Fix regression parsing keys starting with `[`6866874.15.1688======689690  * deps: send@0.15.1691    - Fix issue when `Date.parse` does not return `NaN` on invalid date692    - Fix strict violation in broken environments693  * deps: serve-static@1.12.1694    - Fix issue when `Date.parse` does not return `NaN` on invalid date695    - deps: send@0.15.16966974.15.0698======699700  * Add debug message when loading view engine701  * Add `next("router")` to exit from router702  * Fix case where `router.use` skipped requests routes did not703  * Remove usage of `res._headers` private field704    - Improves compatibility with Node.js 8 nightly705  * Skip routing when `req.url` is not set706  * Use `%o` in path debug to tell types apart707  * Use `Object.create` to setup request & response prototypes708  * Use `setprototypeof` module to replace `__proto__` setting709  * Use `statuses` instead of `http` module for status messages710  * deps: debug@2.6.1711    - Allow colors in workers712    - Deprecated `DEBUG_FD` environment variable set to `3` or higher713    - Fix error when running under React Native714    - Use same color for same namespace715    - deps: ms@0.7.2716  * deps: etag@~1.8.0717    - Use SHA1 instead of MD5 for ETag hashing718    - Works with FIPS 140-2 OpenSSL configuration719  * deps: finalhandler@~1.0.0720    - Fix exception when `err` cannot be converted to a string721    - Fully URL-encode the pathname in the 404722    - Only include the pathname in the 404 message723    - Send complete HTML document724    - Set `Content-Security-Policy: default-src 'self'` header725    - deps: debug@2.6.1726  * deps: fresh@0.5.0727    - Fix false detection of `no-cache` request directive728    - Fix incorrect result when `If-None-Match` has both `*` and ETags729    - Fix weak `ETag` matching to match spec730    - perf: delay reading header values until needed731    - perf: enable strict mode732    - perf: hoist regular expressions733    - perf: remove duplicate conditional734    - perf: remove unnecessary boolean coercions735    - perf: skip checking modified time if ETag check failed736    - perf: skip parsing `If-None-Match` when no `ETag` header737    - perf: use `Date.parse` instead of `new Date`738  * deps: qs@6.3.1739    - Fix array parsing from skipping empty values740    - Fix compacting nested arrays741  * deps: send@0.15.0742    - Fix false detection of `no-cache` request directive743    - Fix incorrect result when `If-None-Match` has both `*` and ETags744    - Fix weak `ETag` matching to match spec745    - Remove usage of `res._headers` private field746    - Support `If-Match` and `If-Unmodified-Since` headers747    - Use `res.getHeaderNames()` when available748    - Use `res.headersSent` when available749    - deps: debug@2.6.1750    - deps: etag@~1.8.0751    - deps: fresh@0.5.0752    - deps: http-errors@~1.6.1753  * deps: serve-static@1.12.0754    - Fix false detection of `no-cache` request directive755    - Fix incorrect result when `If-None-Match` has both `*` and ETags756    - Fix weak `ETag` matching to match spec757    - Remove usage of `res._headers` private field758    - Send complete HTML document in redirect response759    - Set default CSP header in redirect response760    - Support `If-Match` and `If-Unmodified-Since` headers761    - Use `res.getHeaderNames()` when available762    - Use `res.headersSent` when available763    - deps: send@0.15.0764  * perf: add fast match path for `*` route765  * perf: improve `req.ips` performance7667674.14.1768======769770  * deps: content-disposition@0.5.2771  * deps: finalhandler@0.5.1772    - Fix exception when `err.headers` is not an object773    - deps: statuses@~1.3.1774    - perf: hoist regular expressions775    - perf: remove duplicate validation path776  * deps: proxy-addr@~1.1.3777    - deps: ipaddr.js@1.2.0778  * deps: send@0.14.2779    - deps: http-errors@~1.5.1780    - deps: ms@0.7.2781    - deps: statuses@~1.3.1782  * deps: serve-static@~1.11.2783    - deps: send@0.14.2784  * deps: type-is@~1.6.14785    - deps: mime-types@~2.1.137867874.14.0788======789790  * Add `acceptRanges` option to `res.sendFile`/`res.sendfile`791  * Add `cacheControl` option to `res.sendFile`/`res.sendfile`792  * Add `options` argument to `req.range`793    - Includes the `combine` option794  * Encode URL in `res.location`/`res.redirect` if not already encoded795  * Fix some redirect handling in `res.sendFile`/`res.sendfile`796  * Fix Windows absolute path check using forward slashes797  * Improve error with invalid arguments to `req.get()`798  * Improve performance for `res.json`/`res.jsonp` in most cases799  * Improve `Range` header handling in `res.sendFile`/`res.sendfile`800  * deps: accepts@~1.3.3801    - Fix including type extensions in parameters in `Accept` parsing802    - Fix parsing `Accept` parameters with quoted equals803    - Fix parsing `Accept` parameters with quoted semicolons804    - Many performance improvements805    - deps: mime-types@~2.1.11806    - deps: negotiator@0.6.1807  * deps: content-type@~1.0.2808    - perf: enable strict mode809  * deps: cookie@0.3.1810    - Add `sameSite` option811    - Fix cookie `Max-Age` to never be a floating point number812    - Improve error message when `encode` is not a function813    - Improve error message when `expires` is not a `Date`814    - Throw better error for invalid argument to parse815    - Throw on invalid values provided to `serialize`816    - perf: enable strict mode817    - perf: hoist regular expression818    - perf: use for loop in parse819    - perf: use string concatenation for serialization820  * deps: finalhandler@0.5.0821    - Change invalid or non-numeric status code to 500822    - Overwrite status message to match set status code823    - Prefer `err.statusCode` if `err.status` is invalid824    - Set response headers from `err.headers` object825    - Use `statuses` instead of `http` module for status messages826  * deps: proxy-addr@~1.1.2827    - Fix accepting various invalid netmasks828    - Fix IPv6-mapped IPv4 validation edge cases829    - IPv4 netmasks must be contiguous830    - IPv6 addresses cannot be used as a netmask831    - deps: ipaddr.js@1.1.1832  * deps: qs@6.2.0833    - Add `decoder` option in `parse` function834  * deps: range-parser@~1.2.0835    - Add `combine` option to combine overlapping ranges836    - Fix incorrectly returning -1 when there is at least one valid range837    - perf: remove internal function838  * deps: send@0.14.1839    - Add `acceptRanges` option840    - Add `cacheControl` option841    - Attempt to combine multiple ranges into single range842    - Correctly inherit from `Stream` class843    - Fix `Content-Range` header in 416 responses when using `start`/`end` options844    - Fix `Content-Range` header missing from default 416 responses845    - Fix redirect error when `path` contains raw non-URL characters846    - Fix redirect when `path` starts with multiple forward slashes847    - Ignore non-byte `Range` headers848    - deps: http-errors@~1.5.0849    - deps: range-parser@~1.2.0850    - deps: statuses@~1.3.0851    - perf: remove argument reassignment852  * deps: serve-static@~1.11.1853    - Add `acceptRanges` option854    - Add `cacheControl` option855    - Attempt to combine multiple ranges into single range856    - Fix redirect error when `req.url` contains raw non-URL characters857    - Ignore non-byte `Range` headers858    - Use status code 301 for redirects859    - deps: send@0.14.1860  * deps: type-is@~1.6.13861    - Fix type error when given invalid type to match against862    - deps: mime-types@~2.1.11863  * deps: vary@~1.1.0864    - Only accept valid field names in the `field` argument865  * perf: use strict equality when possible8668674.13.4868======869870  * deps: content-disposition@0.5.1871    - perf: enable strict mode872  * deps: cookie@0.1.5873    - Throw on invalid values provided to `serialize`874  * deps: depd@~1.1.0875    - Support web browser loading876    - perf: enable strict mode877  * deps: escape-html@~1.0.3878    - perf: enable strict mode879    - perf: optimize string replacement880    - perf: use faster string coercion881  * deps: finalhandler@0.4.1882    - deps: escape-html@~1.0.3883  * deps: merge-descriptors@1.0.1884    - perf: enable strict mode885  * deps: methods@~1.1.2886    - perf: enable strict mode887  * deps: parseurl@~1.3.1888    - perf: enable strict mode889  * deps: proxy-addr@~1.0.10890    - deps: ipaddr.js@1.0.5891    - perf: enable strict mode892  * deps: range-parser@~1.0.3893    - perf: enable strict mode894  * deps: send@0.13.1895    - deps: depd@~1.1.0896    - deps: destroy@~1.0.4897    - deps: escape-html@~1.0.3898    - deps: range-parser@~1.0.3899  * deps: serve-static@~1.10.2900    - deps: escape-html@~1.0.3901    - deps: parseurl@~1.3.0902    - deps: send@0.13.19039044.13.3905======906907  * Fix infinite loop condition using `mergeParams: true`908  * Fix inner numeric indices incorrectly altering parent `req.params`9099104.13.2911======912913  * deps: accepts@~1.2.12914    - deps: mime-types@~2.1.4915  * deps: array-flatten@1.1.1916    - perf: enable strict mode917  * deps: path-to-regexp@0.1.7918    - Fix regression with escaped round brackets and matching groups919  * deps: type-is@~1.6.6920    - deps: mime-types@~2.1.49219224.13.1923======924925  * deps: accepts@~1.2.10926    - deps: mime-types@~2.1.2927  * deps: qs@4.0.0928    - Fix dropping parameters like `hasOwnProperty`929    - Fix various parsing edge cases930  * deps: type-is@~1.6.4931    - deps: mime-types@~2.1.2932    - perf: enable strict mode933    - perf: remove argument reassignment9349354.13.0936======937938  * Add settings to debug output939  * Fix `res.format` error when only `default` provided940  * Fix issue where `next('route')` in `app.param` would incorrectly skip values941  * Fix hiding platform issues with `decodeURIComponent`942    - Only `URIError`s are a 400943  * Fix using `*` before params in routes944  * Fix using capture groups before params in routes945  * Simplify `res.cookie` to call `res.append`946  * Use `array-flatten` module for flattening arrays947  * deps: accepts@~1.2.9948    - deps: mime-types@~2.1.1949    - perf: avoid argument reassignment & argument slice950    - perf: avoid negotiator recursive construction951    - perf: enable strict mode952    - perf: remove unnecessary bitwise operator953  * deps: cookie@0.1.3954    - perf: deduce the scope of try-catch deopt955    - perf: remove argument reassignments956  * deps: escape-html@1.0.2957  * deps: etag@~1.7.0958    - Always include entity length in ETags for hash length extensions959    - Generate non-Stats ETags using MD5 only (no longer CRC32)960    - Improve stat performance by removing hashing961    - Improve support for JXcore962    - Remove base64 padding in ETags to shorten963    - Support "fake" stats objects in environments without fs964    - Use MD5 instead of MD4 in weak ETags over 1KB965  * deps: finalhandler@0.4.0966    - Fix a false-positive when unpiping in Node.js 0.8967    - Support `statusCode` property on `Error` objects968    - Use `unpipe` module for unpiping requests969    - deps: escape-html@1.0.2970    - deps: on-finished@~2.3.0971    - perf: enable strict mode972    - perf: remove argument reassignment973  * deps: fresh@0.3.0974    - Add weak `ETag` matching support975  * deps: on-finished@~2.3.0976    - Add defined behavior for HTTP `CONNECT` requests977    - Add defined behavior for HTTP `Upgrade` requests978    - deps: ee-first@1.1.1979  * deps: path-to-regexp@0.1.6980  * deps: send@0.13.0981    - Allow Node.js HTTP server to set `Date` response header982    - Fix incorrectly removing `Content-Location` on 304 response983    - Improve the default redirect response headers984    - Send appropriate headers on default error response985    - Use `http-errors` for standard emitted errors986    - Use `statuses` instead of `http` module for status messages987    - deps: escape-html@1.0.2988    - deps: etag@~1.7.0989    - deps: fresh@0.3.0990    - deps: on-finished@~2.3.0991    - perf: enable strict mode992    - perf: remove unnecessary array allocations993  * deps: serve-static@~1.10.0994    - Add `fallthrough` option995    - Fix reading options from options prototype996    - Improve the default redirect response headers997    - Malformed URLs now `next()` instead of 400998    - deps: escape-html@1.0.2999    - deps: send@0.13.01000    - perf: enable strict mode1001    - perf: remove argument reassignment1002  * deps: type-is@~1.6.31003    - deps: mime-types@~2.1.11004    - perf: reduce try block size1005    - perf: remove bitwise operations1006  * perf: enable strict mode1007  * perf: isolate `app.render` try block1008  * perf: remove argument reassignments in application1009  * perf: remove argument reassignments in request prototype1010  * perf: remove argument reassignments in response prototype1011  * perf: remove argument reassignments in routing1012  * perf: remove argument reassignments in `View`1013  * perf: skip attempting to decode zero length string1014  * perf: use saved reference to `http.STATUS_CODES`101510164.12.41017======10181019  * deps: accepts@~1.2.71020    - deps: mime-types@~2.0.111021    - deps: negotiator@0.5.31022  * deps: debug@~2.2.01023    - deps: ms@0.7.11024  * deps: depd@~1.0.11025  * deps: etag@~1.6.01026    - Improve support for JXcore1027    - Support "fake" stats objects in environments without `fs`1028  * deps: finalhandler@0.3.61029    - deps: debug@~2.2.01030    - deps: on-finished@~2.2.11031  * deps: on-finished@~2.2.11032    - Fix `isFinished(req)` when data buffered1033  * deps: proxy-addr@~1.0.81034    - deps: ipaddr.js@1.0.11035  * deps: qs@2.4.21036   - Fix allowing parameters like `constructor`1037  * deps: send@0.12.31038    - deps: debug@~2.2.01039    - deps: depd@~1.0.11040    - deps: etag@~1.6.01041    - deps: ms@0.7.11042    - deps: on-finished@~2.2.11043  * deps: serve-static@~1.9.31044    - deps: send@0.12.31045  * deps: type-is@~1.6.21046    - deps: mime-types@~2.0.11104710484.12.31049======10501051  * deps: accepts@~1.2.51052    - deps: mime-types@~2.0.101053  * deps: debug@~2.1.31054    - Fix high intensity foreground color for bold1055    - deps: ms@0.7.01056  * deps: finalhandler@0.3.41057    - deps: debug@~2.1.31058  * deps: proxy-addr@~1.0.71059    - deps: ipaddr.js@0.1.91060  * deps: qs@2.4.11061    - Fix error when parameter `hasOwnProperty` is present1062  * deps: send@0.12.21063    - Throw errors early for invalid `extensions` or `index` options1064    - deps: debug@~2.1.31065  * deps: serve-static@~1.9.21066    - deps: send@0.12.21067  * deps: type-is@~1.6.11068    - deps: mime-types@~2.0.10106910704.12.21071======10721073  * Fix regression where `"Request aborted"` is logged using `res.sendFile`107410754.12.11076======10771078  * Fix constructing application with non-configurable prototype properties1079  * Fix `ECONNRESET` errors from `res.sendFile` usage1080  * Fix `req.host` when using "trust proxy" hops count1081  * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count1082  * Fix wrong `code` on aborted connections from `res.sendFile`1083  * deps: merge-descriptors@1.0.0108410854.12.01086======10871088  * Fix `"trust proxy"` setting to inherit when app is mounted1089  * Generate `ETag`s for all request responses1090    - No longer restricted to only responses for `GET` and `HEAD` requests1091  * Use `content-type` to parse `Content-Type` headers1092  * deps: accepts@~1.2.41093    - Fix preference sorting to be stable for long acceptable lists1094    - deps: mime-types@~2.0.91095    - deps: negotiator@0.5.11096  * deps: cookie-signature@1.0.61097  * deps: send@0.12.11098    - Always read the stat size from the file1099    - Fix mutating passed-in `options`1100    - deps: mime@1.3.41101  * deps: serve-static@~1.9.11102    - deps: send@0.12.11103  * deps: type-is@~1.6.01104    - fix argument reassignment1105    - fix false-positives in `hasBody` `Transfer-Encoding` check1106    - support wildcard for both type and subtype (`*/*`)1107    - deps: mime-types@~2.0.9110811094.11.21110======11111112  * Fix `res.redirect` double-calling `res.end` for `HEAD` requests1113  * deps: accepts@~1.2.31114    - deps: mime-types@~2.0.81115  * deps: proxy-addr@~1.0.61116    - deps: ipaddr.js@0.1.81117  * deps: type-is@~1.5.61118    - deps: mime-types@~2.0.8111911204.11.11121======11221123  * deps: send@0.11.11124    - Fix root path disclosure1125  * deps: serve-static@~1.8.11126    - Fix redirect loop in Node.js 0.11.141127    - Fix root path disclosure1128    - deps: send@0.11.1112911304.11.01131======11321133  * Add `res.append(field, val)` to append headers1134  * Deprecate leading `:` in `name` for `app.param(name, fn)`1135  * Deprecate `req.param()` -- use `req.params`, `req.body`, or `req.query` instead1136  * Deprecate `app.param(fn)`1137  * Fix `OPTIONS` responses to include the `HEAD` method properly1138  * Fix `res.sendFile` not always detecting aborted connection1139  * Match routes iteratively to prevent stack overflows1140  * deps: accepts@~1.2.21141    - deps: mime-types@~2.0.71142    - deps: negotiator@0.5.01143  * deps: send@0.11.01144    - deps: debug@~2.1.11145    - deps: etag@~1.5.11146    - deps: ms@0.7.01147    - deps: on-finished@~2.2.01148  * deps: serve-static@~1.8.01149    - deps: send@0.11.0115011514.10.81152======11531154  * Fix crash from error within `OPTIONS` response handler1155  * deps: proxy-addr@~1.0.51156    - deps: ipaddr.js@0.1.6115711584.10.71159======11601161  * Fix `Allow` header for `OPTIONS` to not contain duplicate methods1162  * Fix incorrect "Request aborted" for `res.sendFile` when `HEAD` or 3041163  * deps: debug@~2.1.11164  * deps: finalhandler@0.3.31165    - deps: debug@~2.1.11166    - deps: on-finished@~2.2.01167  * deps: methods@~1.1.11168  * deps: on-finished@~2.2.01169  * deps: serve-static@~1.7.21170    - Fix potential open redirect when mounted at root1171  * deps: type-is@~1.5.51172    - deps: mime-types@~2.0.7117311744.10.61175======11761177  * Fix exception in `req.fresh`/`req.stale` without response headers117811794.10.51180======11811182  * Fix `res.send` double-calling `res.end` for `HEAD` requests1183  * deps: accepts@~1.1.41184    - deps: mime-types@~2.0.41185  * deps: type-is@~1.5.41186    - deps: mime-types@~2.0.4118711884.10.41189======11901191  * Fix `res.sendfile` logging standard write errors119211934.10.31194======11951196  * Fix `res.sendFile` logging standard write errors1197  * deps: etag@~1.5.11198  * deps: proxy-addr@~1.0.41199    - deps: ipaddr.js@0.1.51200  * deps: qs@2.3.31201    - Fix `arrayLimit` behavior120212034.10.21204======12051206  * Correctly invoke async router callback asynchronously1207  * deps: accepts@~1.1.31208    - deps: mime-types@~2.0.31209  * deps: type-is@~1.5.31210    - deps: mime-types@~2.0.3121112124.10.11213======12141215  * Fix handling of URLs containing `://` in the path1216  * deps: qs@2.3.21217    - Fix parsing of mixed objects and values121812194.10.01220======12211222  * Add support for `app.set('views', array)`1223    - Views are looked up in sequence in array of directories1224  * Fix `res.send(status)` to mention `res.sendStatus(status)`1225  * Fix handling of invalid empty URLs1226  * Use `content-disposition` module for `res.attachment`/`res.download`1227    - Sends standards-compliant `Content-Disposition` header1228    - Full Unicode support1229  * Use `path.resolve` in view lookup1230  * deps: debug@~2.1.01231    - Implement `DEBUG_FD` env variable support1232  * deps: depd@~1.0.01233  * deps: etag@~1.5.01234    - Improve string performance1235    - Slightly improve speed for weak ETags over 1KB1236  * deps: finalhandler@0.3.21237    - Terminate in progress response only on error1238    - Use `on-finished` to determine request status1239    - deps: debug@~2.1.01240    - deps: on-finished@~2.1.11241  * deps: on-finished@~2.1.11242    - Fix handling of pipelined requests1243  * deps: qs@2.3.01244    - Fix parsing of mixed implicit and explicit arrays1245  * deps: send@0.10.11246    - deps: debug@~2.1.01247    - deps: depd@~1.0.01248    - deps: etag@~1.5.01249    - deps: on-finished@~2.1.11250  * deps: serve-static@~1.7.11251    - deps: send@0.10.1125212534.9.81254=====12551256  * Fix `res.redirect` body when redirect status specified1257  * deps: accepts@~1.1.21258    - Fix error when media type has invalid parameter1259    - deps: negotiator@0.4.9126012614.9.71262=====12631264  * Fix using same param name in array of paths126512664.9.61267=====12681269  * deps: accepts@~1.1.11270    - deps: mime-types@~2.0.21271    - deps: negotiator@0.4.81272  * deps: serve-static@~1.6.41273    - Fix redirect loop when index file serving disabled1274  * deps: type-is@~1.5.21275    - deps: mime-types@~2.0.2127612774.9.51278=====12791280  * deps: etag@~1.4.01281  * deps: proxy-addr@~1.0.31282    - Use `forwarded` npm module1283  * deps: send@0.9.31284    - deps: etag@~1.4.01285  * deps: serve-static@~1.6.31286    - deps: send@0.9.3128712884.9.41289=====12901291  * deps: qs@2.2.41292    - Fix issue with object keys starting with numbers truncated129312944.9.31295=====12961297  * deps: proxy-addr@~1.0.21298    - Fix a global leak when multiple subnets are trusted1299    - deps: ipaddr.js@0.1.3130013014.9.21302=====13031304  * Fix regression for empty string `path` in `app.use`1305  * Fix `router.use` to accept array of middleware without path1306  * Improve error message for bad `app.use` arguments130713084.9.11309=====13101311  * Fix `app.use` to accept array of middleware without path1312  * deps: depd@0.4.51313  * deps: etag@~1.3.11314  * deps: send@0.9.21315    - deps: depd@0.4.51316    - deps: etag@~1.3.11317    - deps: range-parser@~1.0.21318  * deps: serve-static@~1.6.21319    - deps: send@0.9.2132013214.9.01322=====13231324  * Add `res.sendStatus`1325  * Invoke callback for sendfile when client aborts1326    - Applies to `res.sendFile`, `res.sendfile`, and `res.download`1327    - `err` will be populated with request aborted error1328  * Support IP address host in `req.subdomains`1329  * Use `etag` to generate `ETag` headers1330  * deps: accepts@~1.1.01331    - update `mime-types`1332  * deps: cookie-signature@1.0.51333  * deps: debug@~2.0.01334  * deps: finalhandler@0.2.01335    - Set `X-Content-Type-Options: nosniff` header1336    - deps: debug@~2.0.01337  * deps: fresh@0.2.41338  * deps: media-typer@0.3.01339    - Throw error when parameter format invalid on parse1340  * deps: qs@2.2.31341    - Fix issue where first empty value in array is discarded1342  * deps: range-parser@~1.0.21343  * deps: send@0.9.11344    - Add `lastModified` option1345    - Use `etag` to generate `ETag` header1346    - deps: debug@~2.0.01347    - deps: fresh@0.2.41348  * deps: serve-static@~1.6.11349    - Add `lastModified` option1350    - deps: send@0.9.11351  * deps: type-is@~1.5.11352    - fix `hasbody` to be true for `content-length: 0`1353    - deps: media-typer@0.3.01354    - deps: mime-types@~2.0.11355  * deps: vary@~1.0.01356    - Accept valid `Vary` header string as `field`135713584.8.81359=====13601361  * deps: send@0.8.51362    - Fix a path traversal issue when using `root`1363    - Fix malicious path detection for empty string path1364  * deps: serve-static@~1.5.41365    - deps: send@0.8.5136613674.8.71368=====13691370  * deps: qs@2.2.21371    - Remove unnecessary cloning137213734.8.61374=====13751376  * deps: qs@2.2.01377    - Array parsing fix1378    - Performance improvements137913804.8.51381=====13821383  * deps: send@0.8.31384    - deps: destroy@1.0.31385    - deps: on-finished@2.1.01386  * deps: serve-static@~1.5.31387    - deps: send@0.8.3138813894.8.41390=====13911392  * deps: qs@1.2.21393  * deps: send@0.8.21394    - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`1395  * deps: serve-static@~1.5.21396    - deps: send@0.8.2139713984.8.31399=====14001401  * deps: parseurl@~1.3.01402  * deps: qs@1.2.11403  * deps: serve-static@~1.5.11404    - Fix parsing of weird `req.originalUrl` values1405    - deps: parseurl@~1.3.01406    - deps: utils-merge@1.0.0140714084.8.21409=====14101411  * deps: qs@1.2.01412    - Fix parsing array of objects141314144.8.11415=====14161417  * fix incorrect deprecation warnings on `res.download`1418  * deps: qs@1.1.01419    - Accept urlencoded square brackets1420    - Accept empty values in implicit array notation142114224.8.01423=====14241425  * add `res.sendFile`1426    - accepts a file system path instead of a URL1427    - requires an absolute path or `root` option specified1428  * deprecate `res.sendfile` -- use `res.sendFile` instead1429  * support mounted app as any argument to `app.use()`1430  * deps: qs@1.0.21431    - Complete rewrite1432    - Limits array length to 201433    - Limits object depth to 51434    - Limits parameters to 1,0001435  * deps: send@0.8.11436    - Add `extensions` option1437  * deps: serve-static@~1.5.01438    - Add `extensions` option1439    - deps: send@0.8.1144014414.7.41442=====14431444  * fix `res.sendfile` regression for serving directory index files1445  * deps: send@0.7.41446    - Fix incorrect 403 on Windows and Node.js 0.111447    - Fix serving index files without root dir1448  * deps: serve-static@~1.4.41449    - deps: send@0.7.4145014514.7.31452=====14531454  * deps: send@0.7.31455    - Fix incorrect 403 on Windows and Node.js 0.111456  * deps: serve-static@~1.4.31457    - Fix incorrect 403 on Windows and Node.js 0.111458    - deps: send@0.7.3145914604.7.21461=====14621463  * deps: depd@0.4.41464    - Work-around v8 generating empty stack traces1465  * deps: send@0.7.21466    - deps: depd@0.4.41467  * deps: serve-static@~1.4.2146814694.7.11470=====14711472  * deps: depd@0.4.31473    - Fix exception when global `Error.stackTraceLimit` is too low1474  * deps: send@0.7.11475    - deps: depd@0.4.31476  * deps: serve-static@~1.4.1147714784.7.01479=====14801481  * fix `req.protocol` for proxy-direct connections1482  * configurable query parser with `app.set('query parser', parser)`1483    - `app.set('query parser', 'extended')` parse with "qs" module1484    - `app.set('query parser', 'simple')` parse with "querystring" core module1485    - `app.set('query parser', false)` disable query string parsing1486    - `app.set('query parser', true)` enable simple parsing1487  * deprecate `res.json(status, obj)` -- use `res.status(status).json(obj)` instead1488  * deprecate `res.jsonp(status, obj)` -- use `res.status(status).jsonp(obj)` instead1489  * deprecate `res.send(status, body)` -- use `res.status(status).send(body)` instead1490  * deps: debug@1.0.41491  * deps: depd@0.4.21492    - Add `TRACE_DEPRECATION` environment variable1493    - Remove non-standard grey color from color output1494    - Support `--no-deprecation` argument1495    - Support `--trace-deprecation` argument1496  * deps: finalhandler@0.1.01497    - Respond after request fully read1498    - deps: debug@1.0.41499  * deps: parseurl@~1.2.01500    - Cache URLs based on original value1501    - Remove no-longer-needed URL mis-parse work-around1502    - Simplify the "fast-path" `RegExp`1503  * deps: send@0.7.01504    - Add `dotfiles` option1505    - Cap `maxAge` value to 1 year1506    - deps: debug@1.0.41507    - deps: depd@0.4.21508  * deps: serve-static@~1.4.01509    - deps: parseurl@~1.2.01510    - deps: send@0.7.01511  * perf: prevent multiple `Buffer` creation in `res.send`151215134.6.11514=====15151516  * fix `subapp.mountpath` regression for `app.use(subapp)`151715184.6.01519=====15201521  * accept multiple callbacks to `app.use()`1522  * add explicit "Rosetta Flash JSONP abuse" protection1523    - previous versions are not vulnerable; this is just explicit protection1524  * catch errors in multiple `req.param(name, fn)` handlers1525  * deprecate `res.redirect(url, status)` -- use `res.redirect(status, url)` instead1526  * fix `res.send(status, num)` to send `num` as json (not error)1527  * remove unnecessary escaping when `res.jsonp` returns JSON response1528  * support non-string `path` in `app.use(path, fn)`1529    - supports array of paths1530    - supports `RegExp`1531  * router: fix optimization on router exit1532  * router: refactor location of `try` blocks1533  * router: speed up standard `app.use(fn)`1534  * deps: debug@1.0.31535    - Add support for multiple wildcards in namespaces1536  * deps: finalhandler@0.0.31537    - deps: debug@1.0.31538  * deps: methods@1.1.01539    - add `CONNECT`1540  * deps: parseurl@~1.1.31541    - faster parsing of href-only URLs1542  * deps: path-to-regexp@0.1.31543  * deps: send@0.6.01544    - deps: debug@1.0.31545  * deps: serve-static@~1.3.21546    - deps: parseurl@~1.1.31547    - deps: send@0.6.01548  * perf: fix arguments reassign deopt in some `res` methods154915504.5.11551=====15521553 * fix routing regression when altering `req.method`155415554.5.01556=====15571558 * add deprecation message to non-plural `req.accepts*`1559 * add deprecation message to `res.send(body, status)`1560 * add deprecation message to `res.vary()`1561 * add `headers` option to `res.sendfile`1562   - use to set headers on successful file transfer1563 * add `mergeParams` option to `Router`1564   - merges `req.params` from parent routes1565 * add `req.hostname` -- correct name for what `req.host` returns1566 * deprecate things with `depd` module1567 * deprecate `req.host` -- use `req.hostname` instead1568 * fix behavior when handling request without routes1569 * fix handling when `route.all` is only route1570 * invoke `router.param()` only when route matches1571 * restore `req.params` after invoking router1572 * use `finalhandler` for final response handling1573 * use `media-typer` to alter content-type charset1574 * deps: accepts@~1.0.71575 * deps: send@0.5.01576   - Accept string for `maxage` (converted by `ms`)1577   - Include link in default redirect response1578 * deps: serve-static@~1.3.01579   - Accept string for `maxAge` (converted by `ms`)1580   - Add `setHeaders` option1581   - Include HTML link in redirect response1582   - deps: send@0.5.01583 * deps: type-is@~1.3.2158415854.4.51586=====15871588 * deps: cookie-signature@1.0.41589   - fix for timing attacks159015914.4.41592=====15931594 * fix `res.attachment` Unicode filenames in Safari1595 * fix "trim prefix" debug message in `express:router`1596 * deps: accepts@~1.0.51597 * deps: buffer-crc32@0.2.3159815994.4.31600=====16011602 * fix persistence of modified `req.params[name]` from `app.param()`1603 * deps: accepts@1.0.31604   - deps: negotiator@0.4.61605 * deps: debug@1.0.21606 * deps: send@0.4.31607   - Do not throw uncatchable error on file open race condition1608   - Use `escape-html` for HTML escaping1609   - deps: debug@1.0.21610   - deps: finished@1.2.21611   - deps: fresh@0.2.21612 * deps: serve-static@1.2.31613   - Do not throw uncatchable error on file open race condition1614   - deps: send@0.4.3161516164.4.21617=====16181619 * fix catching errors from top-level handlers1620 * use `vary` module for `res.vary`1621 * deps: debug@1.0.11622 * deps: proxy-addr@1.0.11623 * deps: send@0.4.21624   - fix "event emitter leak" warnings1625   - deps: debug@1.0.11626   - deps: finished@1.2.11627 * deps: serve-static@1.2.21628   - fix "event emitter leak" warnings1629   - deps: send@0.4.21630 * deps: type-is@1.2.1163116324.4.11633=====16341635 * deps: methods@1.0.11636 * deps: send@0.4.11637   - Send `max-age` in `Cache-Control` in correct format1638 * deps: serve-static@1.2.11639   - use `escape-html` for escaping1640   - deps: send@0.4.1164116424.4.01643=====16441645 * custom etag control with `app.set('etag', val)`1646   - `app.set('etag', function(body, encoding){ return '"etag"' })` custom etag generation1647   - `app.set('etag', 'weak')` weak tag1648   - `app.set('etag', 'strong')` strong etag1649   - `app.set('etag', false)` turn off1650   - `app.set('etag', true)` standard etag1651 * mark `res.send` ETag as weak and reduce collisions1652 * update accepts to 1.0.21653   - Fix interpretation when header not in request1654 * update send to 0.4.01655   - Calculate ETag with md5 for reduced collisions1656   - Ignore stream errors after request ends1657   - deps: debug@0.8.11658 * update serve-static to 1.2.01659   - Calculate ETag with md5 for reduced collisions1660   - Ignore stream errors after request ends1661   - deps: send@0.4.0166216634.3.21664=====16651666 * fix handling of errors from `router.param()` callbacks166716684.3.11669=====16701671 * revert "fix behavior of multiple `app.VERB` for the same path"1672   - this caused a regression in the order of route execution167316744.3.01675=====16761677 * add `req.baseUrl` to access the path stripped from `req.url` in routes1678 * fix behavior of multiple `app.VERB` for the same path1679 * fix issue routing requests among sub routers1680 * invoke `router.param()` only when necessary instead of every match1681 * proper proxy trust with `app.set('trust proxy', trust)`1682   - `app.set('trust proxy', 1)` trust first hop1683   - `app.set('trust proxy', 'loopback')` trust loopback addresses1684   - `app.set('trust proxy', '10.0.0.1')` trust single IP1685   - `app.set('trust proxy', '10.0.0.1/16')` trust subnet1686   - `app.set('trust proxy', '10.0.0.1, 10.0.0.2')` trust list1687   - `app.set('trust proxy', false)` turn off1688   - `app.set('trust proxy', true)` trust everything1689 * set proper `charset` in `Content-Type` for `res.send`1690 * update type-is to 1.2.01691   - support suffix matching169216934.2.01694=====16951696 * deprecate `app.del()` -- use `app.delete()` instead1697 * deprecate `res.json(obj, status)` -- use `res.json(status, obj)` instead1698   - the edge-case `res.json(status, num)` requires `res.status(status).json(num)`1699 * deprecate `res.jsonp(obj, status)` -- use `res.jsonp(status, obj)` instead1700   - the edge-case `res.jsonp(status, num)` requires `res.status(status).jsonp(num)`1701 * fix `req.next` when inside router instance1702 * include `ETag` header in `HEAD` requests1703 * keep previous `Content-Type` for `res.jsonp`1704 * support PURGE method1705   - add `app.purge`1706   - add `router.purge`1707   - include PURGE in `app.all`1708 * update debug to 0.8.01709   - add `enable()` method1710   - change from stderr to stdout1711 * update methods to 1.0.01712   - add PURGE171317144.1.21715=====17161717 * fix `req.host` for IPv6 literals1718 * fix `res.jsonp` error if callback param is object171917204.1.11721=====17221723 * fix package.json to reflect supported node version172417254.1.01726=====17271728 * pass options from `res.sendfile` to `send`1729 * preserve casing of headers in `res.header` and `res.set`1730 * support unicode file names in `res.attachment` and `res.download`1731 * update accepts to 1.0.11732   - deps: negotiator@0.4.01733 * update cookie to 0.1.21734   - Fix for maxAge == 01735   - made compat with expires field1736 * update send to 0.3.01737   - Accept API options in options object1738   - Coerce option types1739   - Control whether to generate etags1740   - Default directory access to 403 when index disabled1741   - Fix sending files with dots without root set1742   - Include file path in etag1743   - Make "Can't set headers after they are sent." catchable1744   - Send full entity-body for multi range requests1745   - Set etags to "weak"1746   - Support "If-Range" header1747   - Support multiple index paths1748   - deps: mime@1.2.111749 * update serve-static to 1.1.01750   - Accept options directly to `send` module1751   - Resolve relative paths at middleware setup1752   - Use parseurl to parse the URL from request1753   - deps: send@0.3.01754 * update type-is to 1.1.01755   - add non-array values support1756   - add `multipart` as a shorthand175717584.0.01759=====17601761 * remove:1762   - node 0.8 support1763   - connect and connect's patches except for charset handling1764   - express(1) - moved to [express-generator](https://github.com/expressjs/generator)1765   - `express.createServer()` - it has been deprecated for a long time. Use `express()`1766   - `app.configure` - use logic in your own app code1767   - `app.router` - is removed1768   - `req.auth` - use `basic-auth` instead1769   - `req.accepted*` - use `req.accepts*()` instead1770   - `res.location` - relative URL resolution is removed1771   - `res.charset` - include the charset in the content type when using `res.set()`1772   - all bundled middleware except `static`1773 * change:1774   - `app.route` -> `app.mountpath` when mounting an express app in another express app1775   - `json spaces` no longer enabled by default in development1776   - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`1777   - `req.params` is now an object instead of an array1778   - `res.locals` is no longer a function. It is a plain js object. Treat it as such.1779   - `res.headerSent` -> `res.headersSent` to match node.js ServerResponse object1780 * refactor:1781   - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)1782   - `req.is` with [type-is](https://github.com/expressjs/type-is)1783   - [path-to-regexp](https://github.com/component/path-to-regexp)1784 * add:1785   - `app.router()` - returns the app Router instance1786   - `app.route()` - Proxy to the app's `Router#route()` method to create a new route1787   - Router & Route - public API178817893.21.21790======17911792  * deps: connect@2.30.21793    - deps: body-parser@~1.13.31794    - deps: compression@~1.5.21795    - deps: errorhandler@~1.4.21796    - deps: method-override@~2.3.51797    - deps: serve-index@~1.7.21798    - deps: type-is@~1.6.61799    - deps: vhost@~3.0.11800  * deps: vary@~1.0.11801    - Fix setting empty header from empty `field`1802    - perf: enable strict mode1803    - perf: remove argument reassignments180418053.21.11806======18071808  * deps: basic-auth@~1.0.31809  * deps: connect@2.30.11810    - deps: body-parser@~1.13.21811    - deps: compression@~1.5.11812    - deps: errorhandler@~1.4.11813    - deps: morgan@~1.6.11814    - deps: pause@0.1.01815    - deps: qs@4.0.01816    - deps: serve-index@~1.7.11817    - deps: type-is@~1.6.4181818193.21.01820======18211822  * deps: basic-auth@1.0.21823    - perf: enable strict mode1824    - perf: hoist regular expression1825    - perf: parse with regular expressions1826    - perf: remove argument reassignment1827  * deps: connect@2.30.01828    - deps: body-parser@~1.13.11829    - deps: bytes@2.1.01830    - deps: compression@~1.5.01831    - deps: cookie@0.1.31832    - deps: cookie-parser@~1.3.51833    - deps: csurf@~1.8.31834    - deps: errorhandler@~1.4.01835    - deps: express-session@~1.11.31836    - deps: finalhandler@0.4.01837    - deps: fresh@0.3.01838    - deps: morgan@~1.6.01839    - deps: serve-favicon@~2.3.01840    - deps: serve-index@~1.7.01841    - deps: serve-static@~1.10.01842    - deps: type-is@~1.6.31843  * deps: cookie@0.1.31844    - perf: deduce the scope of try-catch deopt1845    - perf: remove argument reassignments1846  * deps: escape-html@1.0.21847  * deps: etag@~1.7.01848    - Always include entity length in ETags for hash length extensions1849    - Generate non-Stats ETags using MD5 only (no longer CRC32)1850    - Improve stat performance by removing hashing1851    - Improve support for JXcore1852    - Remove base64 padding in ETags to shorten1853    - Support "fake" stats objects in environments without fs1854    - Use MD5 instead of MD4 in weak ETags over 1KB1855  * deps: fresh@0.3.01856    - Add weak `ETag` matching support1857  * deps: mkdirp@0.5.11858    - Work in global strict mode1859  * deps: send@0.13.01860    - Allow Node.js HTTP server to set `Date` response header1861    - Fix incorrectly removing `Content-Location` on 304 response1862    - Improve the default redirect response headers1863    - Send appropriate headers on default error response1864    - Use `http-errors` for standard emitted errors1865    - Use `statuses` instead of `http` module for status messages1866    - deps: escape-html@1.0.21867    - deps: etag@~1.7.01868    - deps: fresh@0.3.01869    - deps: on-finished@~2.3.01870    - perf: enable strict mode1871    - perf: remove unnecessary array allocations187218733.20.31874======18751876  * deps: connect@2.29.21877    - deps: body-parser@~1.12.41878    - deps: compression@~1.4.41879    - deps: connect-timeout@~1.6.21880    - deps: debug@~2.2.01881    - deps: depd@~1.0.11882    - deps: errorhandler@~1.3.61883    - deps: finalhandler@0.3.61884    - deps: method-override@~2.3.31885    - deps: morgan@~1.5.31886    - deps: qs@2.4.21887    - deps: response-time@~2.3.11888    - deps: serve-favicon@~2.2.11889    - deps: serve-index@~1.6.41890    - deps: serve-static@~1.9.31891    - deps: type-is@~1.6.21892  * deps: debug@~2.2.01893    - deps: ms@0.7.11894  * deps: depd@~1.0.11895  * deps: proxy-addr@~1.0.81896    - deps: ipaddr.js@1.0.11897  * deps: send@0.12.31898    - deps: debug@~2.2.01899    - deps: depd@~1.0.11900    - deps: etag@~1.6.01901    - deps: ms@0.7.11902    - deps: on-finished@~2.2.1190319043.20.21905======19061907  * deps: connect@2.29.11908    - deps: body-parser@~1.12.21909    - deps: compression@~1.4.31910    - deps: connect-timeout@~1.6.11911    - deps: debug@~2.1.31912    - deps: errorhandler@~1.3.51913    - deps: express-session@~1.10.41914    - deps: finalhandler@0.3.41915    - deps: method-override@~2.3.21916    - deps: morgan@~1.5.21917    - deps: qs@2.4.11918    - deps: serve-index@~1.6.31919    - deps: serve-static@~1.9.21920    - deps: type-is@~1.6.11921  * deps: debug@~2.1.31922    - Fix high intensity foreground color for bold1923    - deps: ms@0.7.01924  * deps: merge-descriptors@1.0.01925  * deps: proxy-addr@~1.0.71926    - deps: ipaddr.js@0.1.91927  * deps: send@0.12.21928    - Throw errors early for invalid `extensions` or `index` options1929    - deps: debug@~2.1.3193019313.20.11932======19331934  * Fix `req.host` when using "trust proxy" hops count1935  * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count193619373.20.01938======19391940  * Fix `"trust proxy"` setting to inherit when app is mounted1941  * Generate `ETag`s for all request responses1942    - No longer restricted to only responses for `GET` and `HEAD` requests1943  * Use `content-type` to parse `Content-Type` headers1944  * deps: connect@2.29.01945    - Use `content-type` to parse `Content-Type` headers1946    - deps: body-parser@~1.12.01947    - deps: compression@~1.4.11948    - deps: connect-timeout@~1.6.01949    - deps: cookie-parser@~1.3.41950    - deps: cookie-signature@1.0.61951    - deps: csurf@~1.7.01952    - deps: errorhandler@~1.3.41953    - deps: express-session@~1.10.31954    - deps: http-errors@~1.3.11955    - deps: response-time@~2.3.01956    - deps: serve-index@~1.6.21957    - deps: serve-static@~1.9.11958    - deps: type-is@~1.6.01959  * deps: cookie-signature@1.0.61960  * deps: send@0.12.11961    - Always read the stat size from the file1962    - Fix mutating passed-in `options`1963    - deps: mime@1.3.4196419653.19.21966======19671968  * deps: connect@2.28.31969    - deps: compression@~1.3.11970    - deps: csurf@~1.6.61971    - deps: errorhandler@~1.3.31972    - deps: express-session@~1.10.21973    - deps: serve-index@~1.6.11974    - deps: type-is@~1.5.61975  * deps: proxy-addr@~1.0.61976    - deps: ipaddr.js@0.1.8197719783.19.11979======19801981  * deps: connect@2.28.21982    - deps: body-parser@~1.10.21983    - deps: serve-static@~1.8.11984  * deps: send@0.11.11985    - Fix root path disclosure198619873.19.01988======19891990  * Fix `OPTIONS` responses to include the `HEAD` method property1991  * Use `readline` for prompt in `express(1)`1992  * deps: commander@2.6.01993  * deps: connect@2.28.11994    - deps: body-parser@~1.10.11995    - deps: compression@~1.3.01996    - deps: connect-timeout@~1.5.01997    - deps: csurf@~1.6.41998    - deps: debug@~2.1.11999    - deps: errorhandler@~1.3.22000    - deps: express-session@~1.10.1