Express

What is a Vulnerability and What’s Not? Making Sense of Node.js and Express Threat Models by Ulises Gascón In this talk, we will discuss security, vulnerabilities, and how to improve your overall security. We will explore various vulnerabilities and the difference between developer errors and misconfigurat...

🔐 Is it a vulnerability, or just a misunderstood feature?

At #NodeCongress2025, I broke it down in my talk: "What is a Vulnerability and What’s Not"

Topics:
👉 Real vs. imagined risks in @nodejs.org and @expressjs.bsky.social
👉 Why #threatModels matter

🎥 Watch: gitnation.com/contents/wha...

Sponsor @bjohansebas on GitHub Sponsors Support bjohansebas's open source work

I’ve been maintaining @expressjs.bsky.social for over 11 months. I’m currently leading the integration of HTTP/2, as well as helping with the documentation redesign and performance improvements. If my work has helped you, consider supporting my open source work:

dub.sh/bjohansebas

The Great Monkey-Patch Safari · Issue #6669 · expressjs/express We want to track down and document all instances of express and our core deps monkey-patching Node core, specifically it's the HTTP internals like IncomingMessage and ServerResponse where we do our...

😏 The Great Monkey-Patch Safari in @expressjs.bsky.social has begun. Join the adventure with critical hacks and hotfixes ahead!

github.com/expressjs/ex...

Say hello to my very old friend @expressjs.bsky.social running on @cloudflare.social workers!

🧑‍🍳 Ideas for new guides or improvements to existing content · expressjs expressjs.com · Discussion #2029 Hey folks, the Express team wants to know what content you’d like to see in the documentation — for example, topics for new guides at any level, or what content could be updated in the existing gui...

Hi Express community!

We’d love your feedback on our website’s content.

✨ What topics or resources would you like us to add?
🔧 What existing content do you think we could improve?

Your input will help us make our docs even better, every idea matters!

github.com/expressjs/ex...

Clean up expressjs org · Issue #134 · expressjs/discussions So while responding to #71 I also realized that there is something on the TC backlog that ideally should get done at some point: go through the repositories in the expressjs org (https://github.com...

We’ve cleaned up @expressjs.bsky.social ! 🧹

Deprecated some legacy packages:
🔥 csurf
🔥 connect-multiparty
🔥 path-match

More context: github.com/expressjs/di...

Blog post coming soon! 📘

We had a great meeting, discussed some of our goals and next steps. You can see some notes here: github.com/expressjs/pe...

We will post the recording to our YouTube when it is ready.

Happening now!

Ulises Gascón is showing off a custom-built futuristic robot during a livestream, combining his passion for open source and robotics in a fun and hands-on way.

🥹 May is almost here, and it's officially #MaintainerMonth 🚀

I’ve helped release @expressjs.bsky.social 5.1, ship key @nodejs.org updates, lead #OpenSource security work, and reboot #Yeoman.

If you believe in supporting #devTools, consider sponsoring ❤️

👉 github.com/sponsors/Uli...

@expressjs.bsky.social has officially surpassed 40 million weekly downloads on npm⚡

2025-05-14 Express Performance Working Group Meeting · Issue #8 · expressjs/perf-wg Date/Time Timezone Date/Time America/Los_Angeles Wed 14-May-2025 08:00 (08:00 AM) America/Denver Wed 14-May-2025 09:00 (09:00 AM) America/Chicago Wed 14-May-2025 10:00 (10:00 AM) America/New_York W...

Tomorrow we are going to have a first informal @expressjs.bsky.social Performance Working Group meeting.

If you are interested in this work, especially longer term, please come and chat. Since it was last minute we are not having an agenda, just an informal discussion.

github.com/expressjs/pe...

Finally getting around to the Performance WG setup for @expressjs.bsky.social. Anyone who is interested, please feel free to start opening issues and participating in the kickoff.

github.com/expressjs/pe...

When I started contributing to the @expressjs.bsky.social site, there were barely any PRs for docs or design.

Today, even though there’s still a lot to improve on the design side, we’ve got a great contributor base, similar to when the site’s development was sponsored by a company back in 2015

Express@5.1.0: Now the Default on npm with LTS Timeline Express 5.1.0 is now the default on npm, and we're introducing an official LTS schedule for the v4 and v5 release lines.

🚀 Exciting Announcement today!

Express v5 is officially "latest" and we have started the maintenance period for v4. Read more about the release and our LTS plans in our blog post: expressjs.com/2025/03/31/v...

Also hoping to call this out in our blog post. Got great reviews (thanks @naugtur.pl 🚀) by posting here yesterday, hope maybe the same will work for the blog post. Reviews welcome!

github.com/expressjs/ex...

feat(ADR): LTS Strategy by wesleytodd · Pull Request #352 · expressjs/discussions A proposal for an LTS strategy with committed dates and next steps. Please see the goals/non-goals for this ADR. I attempted to copy/paste without edits from all the sources we had. I admit there w...

If you have a chance, please take a look at this PR which proposes some concrete details and dates.

github.com/expressjs/di...

With the upcoming release of @expressjs.bsky.social v5 and promoting it to latest on npm, we needed to finalize some of our support and schedule plans. Would love feedback on this plan from the ecosystem so we can do better than we have in the past on keeping folks informed and aware of the plans.

I want to especially thank @bjohansebas.bsky.social for all his work these past months! Not only is a lot of his work in these releases, he has also become our top contributor across the @expressjs.bsky.social project.

expressjs.github.io/statusboard/

Release v2.2.0 · expressjs/body-parser What's Changed test: remove --bail from test script by @Phillip9587 in #583 ci: separate lint step by @Phillip9587 in #582 fix: remove skip of test by @bjohansebas in #589 ci: use lcovonly reporte...

🚀 Just released body-parser@2.2.0 📦

🍿 #release details: github.com/expressjs/bo...

Release 2.0.1 · jshttp/type-is What's Changed Refactor normalizeType function to simplify return statement by @Ayoub-Mabrouk in #61 Refactor tryNormalizeType function for cleaner code by @Ayoub-Mabrouk in #59 Replace deprecated...

🚀 Just released type-is@2.0.1 📦

🍿 #release details: github.com/jshttp/type-...

Release v2.2.0 · pillarjs/router What's Changed docs: remove security file by @bjohansebas in #152 fix: restore 'debug' logs by @dpopp07 in #151 chore: upgrade scorecard workflow pinned action versions by @carpasse in #150 cleanu...

🚀 Just released router@2.2.0 📦

🍿 #release details: github.com/pillarjs/rou...

Release v3.0.1 · jshttp/mime-types What's Changed chore: upgrade scorecard workflow pinned action versions by @carpasse in #130 fix: update mime-db dependency to version 1.54.0 by @bjohansebas in #133 Release 3.0.1 by @UlisesGascon...

🚀 Just released mime-types@3.0.1 📦

🍿 #release details: github.com/jshttp/mime-...

Sponsor @bjohansebas on GitHub Sponsors Support bjohansebas's open source work

For over 6 months, I've been supporting the @expressjs.bsky.social project, improving documentation and maintaining packages like compression. If my contributions have been helpful, it would be great if you could support me:

github.com/sponsors/bjo...

#OpenSource

What is a Vulnerability and What’s Not? Making Sense of Node.js and Express Threat Models by Ulises Gascón Security isn’t just about fixing bugs; it’s about understanding the assumptions we make (and avoiding unnecessary panic). In this talk, we’ll dive into the Node.js and Express threat models, which I c...

🚨 What's REALLY a Vulnerability? 🚨

Join me at #NodeCongress as we break down the @nodejs.org & @expressjs.bsky.social threat models 🔒✨

✅ Real-world examples
✅ Security myths busted
✅ How threat models shape bug bounties & fixes

Let’s rethink #security together! 🚀

gitnation.com/contents/wha...

Release v1.54.0 · jshttp/mime-db What's Changed Add some MS-related extensions and types by @ipetrouchtchak-fi in #336 Update custom-types.json by @robertsky in #343 docs: notice about semver and data sources by @wesleytodd in #3...

mime-db@1.54.0 published 🚀

The most notable change is that application/octet-stream is now marked as compressible. When we update this in the compression middleware this will mean some nice savings over the wire in your express apps.

github.com/jshttp/mime-...

Certain languages can't be matched correctly by the Regular Expression EXT_VALUE_REGEXP like en-US or zh_cn · Issue #47 · jshttp/content-disposition Create and parse HTTP Content-Disposition header. Contribute to jshttp/content-disposition development by creating an account on GitHub.

I love getting nerdsniped on HTTP spec related stuff, and am glad I quit my job to have space in my life for this

was fun to figure out what probably happened with content-disposition having in incomplete regex for parsing extended filename parameters:
github.com/jshttp/conte...

The thank-you message I received for successfully launching a PR made my day 🤗

Not sure this is the one, but pretty sure it is. @bjohansebas.bsky.social has been doing such great work it is awesome to see this kind of recognition! Well deserved.

[WIP] Release Plan: 5.1.0 · Issue #6316 · expressjs/express Remaining Work #6095 #6285 Dependency work accepts body-parser expressjs/body-parser#578 content-disposition https://github.com/jshttp/content-disposition/pulls jshttp/content-disposition#47 jshttp...

Getting 🤏 very close 🤏 to cutting the @expressjs.bsky.social 5.1.0 release which will be when we go latest and officially start the spin down of Express v4.

github.com/expressjs/ex...

I want to take a moment to celebrate some folks doing amazing work. Last year this time we were just kicking off the work to move @expressjs.bsky.social forward. Today I checked our statusboard and it is awesome to see @bjohansebas.bsky.social and Phillip (pbrt.at) as top contributors.