Commit Graph
1247 Commits
Author SHA1 Message Date
ea56b3504b test: added unit tests for utils.compileETag to cover valid and invalid inputs (#6534)
* Added unit tests for utils.compileETag to cover valid and invalid inputs

* test: enhance compileETag tests for various input types

---------

Co-authored-by: sucem029 <[email protected]>
Co-authored-by: Sebastian Beltran <[email protected]>
2026-01-16 21:27:22 -05:00
b778057568 Polish HTML structure of the response in the res.redirect() function (#5167)
* structure the DOM body

* structure the DOM body

* test: add html title to redirect test

* fix: update HTML structure for include body and head tags

* docs: improve HTML structure in res.redirect() responses for better browser compatibility

---------

Co-authored-by: Sebastian Beltran <[email protected]>
2026-01-16 10:29:01 -05:00
7b6414ef59 fix: enhance req.acceptsCharsets method (#6088)
* fix: enhance req.acceptsCharsets method

* Update req.acceptsCharsets.js

---------

Co-authored-by: Monaam Aouini <[email protected]>
Co-authored-by: Sebastian Beltran <[email protected]>
2026-01-07 09:41:34 -05:00
Ulises GasconandJon Church 02ba0dd0fa Revert "sec: security patch for CVE-2024-51999"
This reverts commit 60a19ab26a.
2025-12-01 15:27:35 -05:00
Chris de AlmeidaandUlises Gascon 60a19ab26a sec: security patch for CVE-2024-51999 2025-12-01 17:15:17 +01:00
Sebastian BeltranandGitHub 7865a30bba lib: use req.socket over deprecated req.connection (#6705)
Signed-off-by: Sebastian Beltran <[email protected]>
2025-08-21 10:05:29 -05:00
mountdiskandGitHub f7badca0b9 chore: fix typo (#6609)
Signed-off-by: mountdisk <[email protected].>
2025-07-04 09:47:31 -05:00
Shivam SharmaandGitHub e270ec050a chore: enforce explicit Buffer import and add lint rule (#6525)
Signed-off-by: Shivam Sharma <[email protected]>
2025-06-27 20:10:36 -05:00
7264bda707 test: add coverage for app.listen() variants (#6476)
* test: add coverage for app.listen() variants

- verify alternate signatures (port+host+backlog)
- verify server.address() shape

* fix linter issue

---------

Co-authored-by: kuldeep <[email protected]>
2025-05-28 19:26:16 -05:00
Noritaka KobayashiandGitHub a8b18f8790 test: fix typos in test descriptions (#6535) 2025-05-27 10:36:50 +02:00
Jon ChurchandGitHub 72e9118a6e chore: wider range for query test skip (#6512) 2025-05-15 11:40:26 -05:00
dufucunandGitHub d29ce689d7 fix(test): remove duplicate word (#6456)
Signed-off-by: dufucun <[email protected]>
2025-04-16 11:18:38 -05:00
6506d31ced increased code coverage of utils.js file (#6386)
Co-authored-by: Sebastian Beltran <[email protected]>
2025-04-10 20:57:43 -05:00
Andrea PolverinoandGitHub 06972ceebe feat: Extend res.links() to allow adding multiple links with the same rel (closes #2729) (#4885) 2025-02-14 10:20:53 -06:00
Juan JoséandGitHub 3fc8cdfba0 feat: add support for ETag option in res.sendFile (#6073)
This patch introduces the ability to control the ETag generation
through the `res.sendFile` function. Specifically, the ETag option
is wired to the application's configuration, allowing it to be
enabled or disabled based on the app's settings.

Fixes: https://github.com/expressjs/express/issues/2294

Signed-off-by: Juan José Arboleda <[email protected]>
2025-02-13 13:39:31 -06:00
Alexander CeruttiandWes Todd 2475959fe5 feat: Added check to support Uint8Array in response sending (#6285)
Unified usage of ArrayBuffer.isView to comprehend Buffer and removed isView function check

Co-authored-by: Wes Todd <[email protected]>

Added Uint8Array test with encoding

fix: added history.md entry
2025-02-10 11:23:02 -06:00
Szymon ŁągiewkaandWes Todd 4199d3218f fix(refactor): prefix built-in node module imports
Since v5 relies on node >= 18, this is now possible (since v16, v14.18.0
[^1][^2]).

It's functionally irrelevant:
1. It's not required for CJS nor ESM (with a few exceptions [^3])
2. It has no performance promises

However, there are upsides to this approach:
1. It brings clear boundaries to what's a built-in and what's an
external dependency
2. It reduces the risk of importing unwanted deps where a built-in is
expected
3. It's slightly more interoperable with other JS runtimes that provide
node compatibility[^4], albeit only during development. Once imported
from npm, built-ins are assumed.

[^1]:https://nodejs.org/docs/latest-v22.x/api/modules.html#built-in-modules
[^2]:https://github.com/nodejs/node/pull/37246
[^3]:https://nodejs.org/api/modules.html#built-in-modules-with-mandatory-node-prefix
[^4]:https://docs.deno.com/runtime/fundamentals/node/#using-node's-built-in-modules
2025-01-10 11:53:44 -06:00
Phillip BartaandGitHub f7919e4c27 fix: Remove utils-merge dependency - use spread syntax instead (#6091) 2025-01-08 09:56:16 -06:00
Jon KoopsandGitHub 713c2a6709 chore: replace methods dependency with standard library (#6196) 2025-01-02 08:00:30 +01:00
0deefe5814 cleanup: remove AsyncLocalStorage check from tests (#6147)
Co-authored-by: Wes Todd <[email protected]>
2024-11-15 10:23:42 -06:00
Phillip9587andWes Todd b748a0d705 cleanup: remove unnecessary require for global Buffer
The Buffer object is globally available in Node.js, so there is no need to explicitly require it.
2024-11-15 10:16:29 -06:00
Phillip BartaandGitHub 9f05beb381 chore(test): remove promise support check from tests (#6148)
Promises are supported in all supported Node.js version so the check is unnecessary
2024-11-12 09:30:34 -06:00
Bhavya DhimanandGitHub 72e2b8aed2 fix(buffer): use node:buffer instead of safe-buffer (#6071)
Main Changes:
- Removed dependency `[email protected]`
- Use `node:buffer` core library instead of safe-buffer
2024-10-27 11:10:33 +01:00
Chris de AlmeidaandGitHub 7c974cfa54 test: add discarded middleware test (#5819) 2024-10-20 20:06:49 +02:00
Blake EmbreyandGitHub cae0b6acdc Delete back as a magic string (#5933) 2024-09-09 20:28:55 -07:00
Wes ToddandGitHub d5650ec1f6 Merge branch '5.0' into 5-merge 2024-09-09 21:11:23 -05:00
Wes Todd fb7a3fdd7c Merge tag '4.20.0' into 5.0 2024-09-09 21:07:57 -05:00
Ulises Gascón 74069598ed feat: upgrade to [email protected] 2024-09-10 04:01:43 +02:00
Ulises Gascón 392a57dbed feat: upgrade to [email protected] (#5926)
PR-URL: https://github.com/expressjs/express/pull/5926
2024-09-10 04:01:43 +02:00
Chris de AlmeidaandUlises Gascón 4dcef0f50f fix: don't render redirect values in anchor href
Co-authored-by: Ulises Gascón <[email protected]>
2024-09-10 04:00:58 +02:00
Wes ToddandGitHub 533fd6bddc feat(deps)!: router@^2.0.0 (#5885) 2024-09-09 17:50:11 -05:00
Jon ChurchandGitHub 3682d43c00 update to [email protected] (#5916)
fixes handling of If-Modified-Since in combination with If-None-Match
2024-09-09 17:03:32 -05:00
Wes ToddandGitHub 1936d66551 fix(deps)!: mime-types@^3.0.0 (#5882) 2024-08-31 11:06:25 -05:00
Blake EmbreyandGitHub 7a892efc42 deps: [email protected] (#5603) 2024-08-21 20:15:02 -07:00
ctcpip 6314bfc671 Merge branch '5.0' into 5-merge 2024-08-02 15:38:18 -05:00
e8fe8b0caf Ignore expires and maxAge in res.clearCookie() (#5792)
* add test for removing user provided expires

* rework impl and tests to ignore maxAge, do not set it

this is to take into account the built-in relative expires when passing
a maxAge to res.cookie

I realized that using maxAge to invalidate cookies inherrently hit this
relativee expires behavior, and the goal of this PR is not to rework
that relative expires behavior w/ maxAge, but to prevent users from
overwriting these values by accident when clearing cookies

* update history.md

* explicitly delete maxAge instead of setting as undefined

* drop the spread, use object.assign

* wording, review comment on history.md

Co-authored-by: Chris de Almeida <[email protected]>

* ♻️ use spread, update supported ecmascript version

---------

Co-authored-by: Chris de Almeida <[email protected]>
2024-08-02 15:26:45 -05:00
8a58eb4126 Throw on invalid status codes (#4212)
* check status code is integer, or string integer, in range

* fix tests, update jsdoc comment for res.status

* throw if number is string

* narrow valid range to between 1xx and 5xx

* disambiguate the error message

* update skipped tests, remove invalid string test

* remove invalid float test

* fixup! remove invalid float test

* fix invalid range tests error assertions

* remove unused deprecate function

* add test to assert on 200.00 coming through as 200

this is the behavior of node's underlying HTTP module

* revert back to throwing only on > 999 and < 100

* update implementation for > 999

* add test for 700 status code

* update history with change

* update jsdoc

* clarify jsdoc comment

* one more round of jsdoc

* update 501 test

* add invalid status code test for res.sendStatus

* add test describe block for valid range

* fixup! add test describe block for valid range

* reduce the describe nesting

* switch to testing status 100, to avoid 100-continue behavior

* fix 900 test

* stringify code in thrown RangeError message

* remove accidentally duplicated res.status method

* fix error range message

Co-authored-by: Chris de Almeida <[email protected]>

* update sendStatus invalid code test to use sendStatus

---------

Co-authored-by: Chris de Almeida <[email protected]>
2024-07-30 14:49:13 -07:00
ctcpip c22ef5bb15 Merge branch 'master' into 5.0 2024-07-25 16:55:48 -05:00
Jon ChurchandGitHub a5ce6a4960 skip QUERY tests for Node 21 only, still not supported (#5695)
* skip QUERY tests for Node 21 only, still not supported

QUERY support has now landed in Node 22.2.0, but is still not supported
in 21.7.3

QUERY showed up in http.METHODS in 21.7.2. Only Node versions after that
will attempt to run tests for it, based on the way we dynamically test
members of the http.METHODS array from Node

* update CI to run on 21.7 and 22.2
2024-06-08 23:25:42 -04:00
0792674d83 [v4] Deprecate res.clearCookie accepting options.maxAge and options.expires (#5672)
* add deprecation notice for res.clearCookie maxAge/expires

* update History.md for clearCookie deprecation change

* add tests to codify deprecated behavior

Co-authored-by: Chris de Almeida <[email protected]>

---------

Co-authored-by: Chris de Almeida <[email protected]>
2024-06-07 19:48:48 -04:00
Chris de AlmeidaandGitHub d279f9e7b1 ✨ bring back query tests for node 21 (#5690) 2024-06-05 17:25:58 -04:00
Wes 0daefa0fb7 call callback once on listen error 2024-05-17 13:47:56 -07:00
Jon ChurchandGitHub b5ae566c89 ignore ETAG query test as well, reuse skip util (#5639) 2024-05-04 18:01:42 -04:00
Jon ChurchandGitHub e164aee1e4 skip QUERY method test (#5628) 2024-05-04 17:09:52 -04:00
Blake EmbreyandGitHub 67f5068627 deps: encodeurl@~2.0.0 (#5569) 2024-05-04 16:53:09 -04:00
Evan HahnandWes Todd a716f6270b Use object with null prototype for various app properties
`app.cache`, `app.engines`, and `app.settings` are now created with
`Object.create(null)` instead of `{}`.

This also updates a test to ensure that `app.locals` is created the same
way.
2024-04-29 09:43:25 -05:00
Wes Todd 089622988a remove duplicate location test for data uri 2024-03-26 09:41:06 -05:00
Wes Todd 6b81c643c9 Merge tag '4.19.2' into 5.0
4.19.2
2024-03-25 09:37:02 -05:00
baa5bcd838 Improved fix for open redirect allow list bypass
Co-authored-by: Jon Church <[email protected]>
Co-authored-by: Blake Embrey <[email protected]>
2024-03-25 09:29:41 -05:00
c4aa56593d Improved fix for open redirect allow list bypass
Co-authored-by: Jon Church <[email protected]>
Co-authored-by: Blake Embrey <[email protected]>
2024-03-25 09:22:34 -05:00