2408 Commits
Author SHA1 Message Date
417061da46 feat: allow conditional revalidation for QUERY requests (#7366)
* feat: allow conditional revalidation for QUERY requests

req.fresh only validated freshness for GET and HEAD, so QUERY responses never returned 304 despite a matching If-None-Match. QUERY is a safe, idempotent, cacheable method that supports conditional requests, so include it in the freshness check.

* docs: include history

---------

Co-authored-by: Sebastian Beltran <[email protected]>
2026-07-12 13:22:00 -05:00
246818a5a3 fix(res.send): add Content-Length header only if Transfer-Encoding is not present (#4893)
* fix(respond): add Content-Length header only if Transfer-Encoding is not present

* fix(response): used get('Transfer-Encoding')

* test(res.send): covered Transfer-Encoding and Content-Length headers logic

* chore(response): removed comment

* chore(res.redirect): revert changes to focus on res.send

* test(res.send): added tests for all transfer encodings

* docs: update History.md to include bug fix for HTTP header conflict in res.send()

---------

Co-authored-by: Sebastian Beltran <[email protected]>
2026-06-15 22:06:31 -05:00
0065edc45d Upgrade content-disposition (#7233)
* Upgrade content-disposition

* Better backward compat

* chore: upgrade content-disposition to 2.0.1 and update History.md

* test: add case for encoding latin1 file names with ASCII fallback in attachment

* test: add cases for quoting invalid file names and handling empty file names in attachment

---------

Co-authored-by: Sebastian Beltran <[email protected]>
2026-06-15 21:45:22 -05:00
TEJandGitHub 0b623ac7e5 fix: replace deprecated trimRight() with trimEnd() (#7265) 2026-06-15 21:34:06 -05:00
9bcc099fd0 Improve error logging by logging full error object (#6464)
* Improved error logging: log full error object instead of stack trace

* docs: update History.md to reflect changes in error logging behavior

---------

Co-authored-by: Sebastian Beltran <[email protected]>
2026-06-15 15:36:43 -05:00
c0680401b6 feat: Allow passing null or undefined as the value for options in app.render (#6903)
* fix: allow null options in app.render

* fix: ensure options are initialized to an empty object in app.render

* docs: add history entry

---------

Co-authored-by: Sebastian Beltran <[email protected]>
2026-01-31 21:51:17 -05:00
Sebastian BeltranandGitHub 10aabb09f5 feat: do not modify the Content-Type twice when sending strings (#6991)
* fix: improve content-type handling in res.send method

* fix: ensure content-type is a string before setting charset in res.send

* fix: refactor content-type handling in res.send to use const and improve clarity

* Apply suggestion from @bjohansebas

* docs: update History.md
2026-01-19 09:56:53 -05:00
Marcos MolinaandGitHub 5bf5075b60 docs: fix JSDoc for req.accepts() return value and parameter format (#6936)
* fixed request accept jsdoc

* reverted format

* reverted format

* updated jsdoc

* updated the rest of the documentation
2026-01-16 16:19:39 -05:00
b778057568 Polish HTML structure of the response in the res.redirect() function (#5167)
* structure the DOM body

* structure the DOM body

* test: add html title to redirect test

* fix: update HTML structure for include body and head tags

* docs: improve HTML structure in res.redirect() responses for better browser compatibility

---------

Co-authored-by: Sebastian Beltran <[email protected]>
2026-01-16 10:29:01 -05:00
7b6414ef59 fix: enhance req.acceptsCharsets method (#6088)
* fix: enhance req.acceptsCharsets method

* Update req.acceptsCharsets.js

---------

Co-authored-by: Monaam Aouini <[email protected]>
Co-authored-by: Sebastian Beltran <[email protected]>
2026-01-07 09:41:34 -05:00
Ulises GasconandJon Church 02ba0dd0fa Revert "sec: security patch for CVE-2024-51999"
This reverts commit 60a19ab26a.
2025-12-01 15:27:35 -05:00
Chris de AlmeidaandUlises Gascon 60a19ab26a sec: security patch for CVE-2024-51999 2025-12-01 17:15:17 +01:00
TheMysteriousandGitHub 706065cb75 refactor: use cached slice in app.listen (#6897)
Signed-off-by: Tacit1 <[email protected]>
2025-11-23 18:52:16 -05:00
Sebastian BeltranandGitHub 7865a30bba lib: use req.socket over deprecated req.connection (#6705)
Signed-off-by: Sebastian Beltran <[email protected]>
2025-08-21 10:05:29 -05:00
Sebastian BeltranandGitHub 75c54fe017 feat: add deprecation warnings for redirect arguments undefined (#6405) 2025-07-14 22:18:10 -05:00
d9d0fd91f8 chore: use node protocol for node builtin module (#6520)
Co-authored-by: Sebastian Beltran <[email protected]>
2025-07-02 21:33:10 -05:00
Shivam SharmaandGitHub e270ec050a chore: enforce explicit Buffer import and add lint rule (#6525)
Signed-off-by: Shivam Sharma <[email protected]>
2025-06-27 20:10:36 -05:00
Ayoub MabroukandGitHub 172b4e640d Refactor: simplify acceptsLanguages implementation using spread operator (#6137)
Refactored `req.acceptsLanguages` to use the spread operator for passing arguments directly to `accept.languages`, eliminating the need for `.apply`. This approach improves readability and streamlines the function call.
2025-04-10 20:49:23 -05:00
Andrea PolverinoandGitHub 06972ceebe feat: Extend res.links() to allow adding multiple links with the same rel (closes #2729) (#4885) 2025-02-14 10:20:53 -06:00
Juan JoséandGitHub 3fc8cdfba0 feat: add support for ETag option in res.sendFile (#6073)
This patch introduces the ability to control the ETag generation
through the `res.sendFile` function. Specifically, the ETag option
is wired to the application's configuration, allowing it to be
enabled or disabled based on the app's settings.

Fixes: https://github.com/expressjs/express/issues/2294

Signed-off-by: Juan José Arboleda <[email protected]>
2025-02-13 13:39:31 -06:00
Alexander CeruttiandWes Todd 2475959fe5 feat: Added check to support Uint8Array in response sending (#6285)
Unified usage of ArrayBuffer.isView to comprehend Buffer and removed isView function check

Co-authored-by: Wes Todd <[email protected]>

Added Uint8Array test with encoding

fix: added history.md entry
2025-02-10 11:23:02 -06:00
Ayoub MabroukandGitHub 818ec39673 refactor: simplify normalizeTypes function (#6097) 2025-02-04 11:59:48 +01:00
Szymon ŁągiewkaandWes Todd 4199d3218f fix(refactor): prefix built-in node module imports
Since v5 relies on node >= 18, this is now possible (since v16, v14.18.0
[^1][^2]).

It's functionally irrelevant:
1. It's not required for CJS nor ESM (with a few exceptions [^3])
2. It has no performance promises

However, there are upsides to this approach:
1. It brings clear boundaries to what's a built-in and what's an
external dependency
2. It reduces the risk of importing unwanted deps where a built-in is
expected
3. It's slightly more interoperable with other JS runtimes that provide
node compatibility[^4], albeit only during development. Once imported
from npm, built-ins are assumed.

[^1]:https://nodejs.org/docs/latest-v22.x/api/modules.html#built-in-modules
[^2]:https://github.com/nodejs/node/pull/37246
[^3]:https://nodejs.org/api/modules.html#built-in-modules-with-mandatory-node-prefix
[^4]:https://docs.deno.com/runtime/fundamentals/node/#using-node's-built-in-modules
2025-01-10 11:53:44 -06:00
Phillip BartaandGitHub f7919e4c27 fix: Remove utils-merge dependency - use spread syntax instead (#6091) 2025-01-08 09:56:16 -06:00
Jon KoopsandGitHub 713c2a6709 chore: replace methods dependency with standard library (#6196) 2025-01-02 08:00:30 +01:00
Phillip9587andWes Todd b748a0d705 cleanup: remove unnecessary require for global Buffer
The Buffer object is globally available in Node.js, so there is no need to explicitly require it.
2024-11-15 10:16:29 -06:00
Blake EmbreyandGitHub 0a9f09ca92 Use loop for acceptParams (#6066) 2024-11-14 16:01:25 -05:00
Bhavya DhimanandGitHub 72e2b8aed2 fix(buffer): use node:buffer instead of safe-buffer (#6071)
Main Changes:
- Removed dependency `[email protected]`
- Use `node:buffer` core library instead of safe-buffer
2024-10-27 11:10:33 +01:00
Phillip BartaandGitHub 7134549ef9 refactor: Remove Object.setPrototypeOf polyfill (#6081) 2024-10-22 20:22:26 +02:00
Blake EmbreyandGitHub cae0b6acdc Delete back as a magic string (#5933) 2024-09-09 20:28:55 -07:00
Wes ToddandGitHub d5650ec1f6 Merge branch '5.0' into 5-merge 2024-09-09 21:11:23 -05:00
Wes Todd fb7a3fdd7c Merge tag '4.20.0' into 5.0 2024-09-09 21:07:57 -05:00
Chris de AlmeidaandUlises Gascón 4dcef0f50f fix: don't render redirect values in anchor href
Co-authored-by: Ulises Gascón <[email protected]>
2024-09-10 04:00:58 +02:00
Jon ChurchandGitHub 3682d43c00 update to [email protected] (#5916)
fixes handling of If-Modified-Since in combination with If-None-Match
2024-09-09 17:03:32 -05:00
Carlos SerranoandGitHub 9e947d625c refactor: replace 'path-is-absolute' dep with node:path isAbsolute method (#5830)
* refactor: replace 'path-is-absolute' dep with node:path isAbsolute method

* docs: add path-is-absolute dep removal to History.md
2024-08-17 10:21:29 -05:00
ctcpip 6314bfc671 Merge branch '5.0' into 5-merge 2024-08-02 15:38:18 -05:00
e8fe8b0caf Ignore expires and maxAge in res.clearCookie() (#5792)
* add test for removing user provided expires

* rework impl and tests to ignore maxAge, do not set it

this is to take into account the built-in relative expires when passing
a maxAge to res.cookie

I realized that using maxAge to invalidate cookies inherrently hit this
relativee expires behavior, and the goal of this PR is not to rework
that relative expires behavior w/ maxAge, but to prevent users from
overwriting these values by accident when clearing cookies

* update history.md

* explicitly delete maxAge instead of setting as undefined

* drop the spread, use object.assign

* wording, review comment on history.md

Co-authored-by: Chris de Almeida <[email protected]>

* ♻️ use spread, update supported ecmascript version

---------

Co-authored-by: Chris de Almeida <[email protected]>
2024-08-02 15:26:45 -05:00
Mick A.andGitHub 040a1c1f65 Use Array.flat instead of array-flatten (#5677) 2024-08-01 19:42:07 -04:00
8a58eb4126 Throw on invalid status codes (#4212)
* check status code is integer, or string integer, in range

* fix tests, update jsdoc comment for res.status

* throw if number is string

* narrow valid range to between 1xx and 5xx

* disambiguate the error message

* update skipped tests, remove invalid string test

* remove invalid float test

* fixup! remove invalid float test

* fix invalid range tests error assertions

* remove unused deprecate function

* add test to assert on 200.00 coming through as 200

this is the behavior of node's underlying HTTP module

* revert back to throwing only on > 999 and < 100

* update implementation for > 999

* add test for 700 status code

* update history with change

* update jsdoc

* clarify jsdoc comment

* one more round of jsdoc

* update 501 test

* add invalid status code test for res.sendStatus

* add test describe block for valid range

* fixup! add test describe block for valid range

* reduce the describe nesting

* switch to testing status 100, to avoid 100-continue behavior

* fix 900 test

* stringify code in thrown RangeError message

* remove accidentally duplicated res.status method

* fix error range message

Co-authored-by: Chris de Almeida <[email protected]>

* update sendStatus invalid code test to use sendStatus

---------

Co-authored-by: Chris de Almeida <[email protected]>
2024-07-30 14:49:13 -07:00
ctcpip c22ef5bb15 Merge branch 'master' into 5.0 2024-07-25 16:55:48 -05:00
0792674d83 [v4] Deprecate res.clearCookie accepting options.maxAge and options.expires (#5672)
* add deprecation notice for res.clearCookie maxAge/expires

* update History.md for clearCookie deprecation change

* add tests to codify deprecated behavior

Co-authored-by: Chris de Almeida <[email protected]>

---------

Co-authored-by: Chris de Almeida <[email protected]>
2024-06-07 19:48:48 -04:00
Wes 0daefa0fb7 call callback once on listen error 2024-05-17 13:47:56 -07:00
Blake EmbreyandGitHub 67f5068627 deps: encodeurl@~2.0.0 (#5569) 2024-05-04 16:53:09 -04:00
Evan HahnandWes Todd 32cce1733b Use object with null prototype for settings closes #4835 2024-04-29 10:12:23 -05:00
Evan HahnandWes Todd a716f6270b Use object with null prototype for various app properties
`app.cache`, `app.engines`, and `app.settings` are now created with
`Object.create(null)` instead of `{}`.

This also updates a test to ensure that `app.locals` is created the same
way.
2024-04-29 09:43:25 -05:00
Wes Todd 6b81c643c9 Merge tag '4.19.2' into 5.0
4.19.2
2024-03-25 09:37:02 -05:00
baa5bcd838 Improved fix for open redirect allow list bypass
Co-authored-by: Jon Church <[email protected]>
Co-authored-by: Blake Embrey <[email protected]>
2024-03-25 09:29:41 -05:00
c4aa56593d Improved fix for open redirect allow list bypass
Co-authored-by: Jon Church <[email protected]>
Co-authored-by: Blake Embrey <[email protected]>
2024-03-25 09:22:34 -05:00
Wes Todd 21a757e824 Merge tag '4.19.1' into 5.x
4.19.1
2024-03-20 21:17:26 -05:00
Wes Todd 408d869385 Merge tag '4.19.0' into 5.x
4.19.0
2024-03-20 21:14:00 -05:00