ExpressJS 4.16.2

Express is a fast and minimalistic web framework for NodeJS. It provides robust routing, HTTP utility code (redirection, caching, etc), view and templating system (over 14 engines) support, HTTP content negotiation, and code generation.

Tags javascript web-framework nodejs templating web-apps developers
License MITL
State stable

Recent Releases

4.16.210 Oct 2017 12:25 minor bugfix: `TypeError` in `res.send` when given `Buffer` and `ETag` header set. Perf: skip parsing of entire `X-Forwarded-Proto` header.
4.16.102 Oct 2017 00:25 minor bugfix: Deps: send@0.16.1. Deps: serve-static@1.13.1. Regression when `root` is incorrectly set to a file. Deps: send@0.16.1.
4.15.526 Sep 2017 13:25 minor bugfix: Deps: de@2.6.9. Deps: finalhandler@ 1.0.6. Deps: de@2.6.9. Deps: parseurl@ 1.3.2. Deps: fresh@0.5.2. Handling of modified headers with invalid dates. Perf: improve ETag match loop. Perf: improve `If-None-Match` token parsing. Deps: send@0.15.6. Handling of modified headers with invalid dates. Deps: de@2.6.9. Deps: etag@ 1.8.1. Deps: fresh@0.5.2. Perf: improve `If-Match` token parsing. Deps: serve-static@1.12.6. Deps: parseurl@ 1.3.2. Deps: send@0.15.6. Perf: improve slash collapsing.
4.15.408 Aug 2017 02:25 minor bugfix: Deps: de@2.6.8. Deps: depd@ 1.1.1. - Remove unnecessary `Buffer` loading. Deps: finalhandler@ 1.0.4. Deps: de@2.6.8. Deps: proxy-addr@ 1.1.5. Array argument being altered. Deps: ipaddr.js@1.4.0. Deps: qs@6.5.0. Deps: send@0.15.4. Deps: de@2.6.8. Deps: depd@ 1.1.1. Deps: http-errors@ 1.6.2. Deps: serve-static@1.12.4. Deps: send@0.15.4.
4.15.318 May 2017 19:45 minor bugfix: Error when `res.set` cannot add charset to `Content-Type`. Deps: de@2.6.7. - `DE_MAX_ARRAY_LENGTH`. Deps: ms@2.0.0. Deps: finalhandler@ 1.0.3. Missing `` in HTML document. Deps: de@2.6.7. Deps: proxy-addr@ 1.1.4. Deps: ipaddr.js@1.3.0. Deps: send@0.15.3. Deps: de@2.6.7. Deps: ms@2.0.0. Deps: serve-static@1.12.3. Deps: send@0.15.3. Deps: type-is@ 1.6.15. Deps: mime-types@ 2.1.15. Deps: vary@ 1.1.1. Perf: hoist regular expression.
4.15.002 Mar 2017 13:45 major bugfix: Add demessage when loading view engine. Add `next("router")` to exit from router. Case where `router.use` skipped requests routes did not. Remove usage of `res._headers` private field. - Improves compatibility with Node.js 8 nightly. Skip routing when `req.url` is not set. Use ` o` in path deto tell types apart. Use `Object.create` to setup request response prototypes. Use `setprototypeof` module to replace `__proto__` setting. Use `statuses` instead of `http` module for status messages. Deps: de@2.6.1. - Allow colors in workers. - Deprecated `DE_FD` environment variable set to `3` or higher. Error when running under React Native. - Use same color for same namespace. Deps: ms@0.7.2. Deps: etag@ 1.8.0. - Use SHA1 instead of MD5 for ETag hashing. - Works with FIPS 140-2 OpenSSL configuration. Deps: finalhandler@ 1.0.0. Exception when `err` cannot be converted to a string. - Fully URL-encode the pathname in the 404. - Only include the pathname in the 404 message. - Send complete HTML document. - Set `Content-Security-Policy: default-src 'self'` header. Deps: de@2.6.1. Deps: fresh@0.5.0. False detection of `no-cache` request directive. Incorrect result when `If-None-Match` has both `*` and ETags. Weak `ETag` matching to match spec. Perf: delay reading header values until needed. Perf: enable strict mode. Perf: hoist regular expressions. Perf: remove duplicate conditional. Perf: remove unnecessary boolean coercions. Perf: skip checking modified time if ETag check failed. Perf: skip parsing `If-None-Match` when no `ETag` header. Perf: use `Date.parse` instead of `new Date`. Deps: qs@6.3.1. Array parsing from skipping empty values. Compacting nested arrays. Deps: send@0.15.0. False detection of `no-cache` request directive. Incorrect result when `If-None-Match` has both `*` and ETags. Weak `ETag` matching to match spec. - Remove usage of `res._headers` private field. - Support `If-Match` and `If-Unmodified-Since` headers. - Use `res.getHeaderNa
4.14.130 Jan 2017 00:05 minor bugfix: Deps: content-disposition@0.5.2. Deps: finalhandler@0.5.1. Exception when `err.headers` is not an object. Deps: statuses@ 1.3.1. Perf: hoist regular expressions. Perf: remove duplicate validation path. Deps: proxy-addr@ 1.1.3. Deps: ipaddr.js@1.2.0. Deps: send@0.14.2. Deps: http-errors@ 1.5.1. Deps: ms@0.7.2. Deps: statuses@ 1.3.1. Deps: serve-static@ 1.11.2. Deps: send@0.14.2. Deps: type-is@ 1.6.14. Deps: mime-types@ 2.1.13.
4.14.017 Jun 2016 07:45 major bugfix: Add `acceptRanges` option to `res.sendFile`/`res.sendfile`. Add `cacheControl` option to `res.sendFile`/`res.sendfile`. Add `options` argument to `req.range`. - Includes the `combine` option. Encode URL in `res.location`/`res.redirect` if not already encoded. Some redirect handling in `res.sendFile`/`res.sendfile`. Windows absolute path check using forward slashes. Improve error with invalid arguments to `req.get()`. Improve performance for `res.json`/`res.jsonp` in most cases. Improve `Range` header handling in `res.sendFile`/`res.sendfile`. Deps: accepts@ 1.3.3. Including type extensions in parameters in `Accept` parsing. Parsing `Accept` parameters with quoted equals. Parsing `Accept` parameters with quoted semicolons. - Many performance improvments. Deps: mime-types@ 2.1.11. Deps: negotiator@0.6.1. Deps: content-type@ 1.0.2. Perf: enable strict mode. Deps: cookie@0.3.1. - Add `sameSite` option. Cookie `Max-Age` to never be a floating point number. - Improve error message when `encode` is not a function. - Improve error message when `expires` is not a `Date`. - Throw better error for invalid argument to parse. - Throw on invalid values provided to `serialize`. Perf: enable strict mode. Perf: hoist regular expression. Perf: use for loop in parse. Perf: use string concatination for serialization. Deps: finalhandler@0.5.0. - Change invalid or non-numeric status code to 500. - Overwrite status message to match set status code. - Prefer `err.statusCode` if `err.status` is invalid. - Set response headers from `err.headers` object. - Use `statuses` instead of `http` module for status messages. Deps: proxy-addr@ 1.1.2. Accepting various invalid netmasks. - IPv6-mapped IPv4 validation edge cases. - IPv4 netmasks must be contingous. - IPv6 addresses cannot be used as a netmask. Deps: ipaddr.js@1.1.1. Deps: qs@6.2.0. - Add `decoder` option in `parse` function. Deps: range-parser@ 1.2.0. - Add `combine` option to combine overlapping ranges. Incorrectly
4.13.411 Feb 2016 09:45 minor feature: Deps: content-disposition@0.5.1. Perf: enable strict mode. Deps: cookie@0.1.5. - Throw on invalid values provided to `serialize`. Deps: depd@ 1.1.0. - Support web browser loading. Perf: enable strict mode. Deps: escape-html@ 1.0.3. Perf: enable strict mode. Perf: optimize string replacement. Perf: use faster string coercion. Deps: finalhandler@0.4.1. Deps: escape-html@ 1.0.3. Deps: merge-descriptors@1.0.1. Perf: enable strict mode. Deps: methods@ 1.1.2. Perf: enable strict mode. Deps: parseurl@ 1.3.1. Perf: enable strict mode. Deps: proxy-addr@ 1.0.10. Deps: ipaddr.js@1.0.5. Perf: enable strict mode. Deps: range-parser@ 1.0.3. Perf: enable strict mode. Deps: send@0.13.1. Deps: depd@ 1.1.0. Deps: destroy@ 1.0.4. Deps: escape-html@ 1.0.3. Deps: range-parser@ 1.0.3. Deps: serve-static@ 1.10.2. Deps: escape-html@ 1.0.3. Deps: parseurl@ 1.3.0. Deps: send@0.13.1.
4.13.305 Aug 2015 11:25 minor feature: Fix infinite loop condition using `mergeParams: true`. Fix inner numeric indices incorrectly altering parent `req.params`.
4.13.201 Aug 2015 20:25 minor feature: deps: accepts@ 1.2.12. - deps: mime-types@ 2.1.4. deps: array-flatten@1.1.1. - perf: enable strict mode. deps: path-to-regexp@0.1.7. - Fix regression with escaped round brackets and matching groups. deps: type-is@ 1.6.6. - deps: mime-types@ 2.1.4.
4.13.107 Jul 2015 18:45 minor feature: deps: accepts@ 1.2.10. - deps: mime-types@ 2.1.2. deps: qs@4.0.0. - Fix dropping parameters like `hasOwnProperty`. - Fix various parsing edge cases. deps: type-is@ 1.6.4. - deps: mime-types@ 2.1.2. - perf: enable strict mode. - perf: remove argument reassignment.
4.13.022 Jun 2015 03:45 minor feature: Add settings to debug output. Fix `res.format` error when only `default` provided. Fix issue where `next('route')` in `app.param` would incorrectly skip values. Fix hiding platform issues with `decodeURIComponent`. - Only `URIError`s are a 400. Fix using `*` before params in routes. Fix using capture groups before params in routes. Simplify `res.cookie` to call `res.append`. Use `array-flatten` module for flattening arrays. deps: accepts@ 1.2.9. - deps: mime-types@ 2.1.1. - perf: avoid argument reassignment argument slice. - perf: avoid negotiator recursive construction. - perf: enable strict mode. - perf: remove unnecessary bitwise operator. deps: cookie@0.1.3. - perf: deduce the scope of try-catch deopt. - perf: remove argument reassignments. deps: escape-html@1.0.2. deps: etag@ 1.7.0. - Always include entity length in ETags for hash length extensions. - Generate non-Stats ETags using MD5 only (no longer CRC32). - Improve stat performance by removing hashing. - Improve support for JXcore. - Remove base64 padding in ETags to shorten. - Support "fake" stats objects in environments without fs. - Use MD5 instead of MD4 in weak ETags over 1KB. deps: finalhandler@0.4.0. - Fix a false-positive when unpiping in Node.js 0.8. - Support `statusCode` property on `Error` objects. - Use `unpipe` module for unpiping requests. - deps: escape-html@1.0.2. - deps: on-finished@ 2.3.0. - perf: enable strict mode. - perf: remove argument reassignment. deps: fresh@0.3.0. - Add weak `ETag` matching support. deps: on-finished@ 2.3.0. - Add defined behavior for HTTP `CONNECT` requests. - Add defined behavior for HTTP `Upgrade` requests. - deps: ee-first@1.1.1. deps: path-to-regexp@0.1.6. deps: send@0.13.0. - Allow Node.js HTTP server to set `Date` response header. - Fix incorrectly removing `Content-Location` on 304 response. - Improve the default redirect response headers. - Send appropriate headers on default error response. - Use `http-errors` for standard emitted errors. - Use `statu
4.12.419 May 2015 03:16 minor feature: deps: accepts@ 1.2.7. - deps: mime-types@ 2.0.11. - deps: negotiator@0.5.3. * deps: debug@ 2.2.0. - deps: ms@0.7.1. * deps: depd@ 1.0.1. * deps: etag@ 1.6.0. - Improve support for JXcore. - Support "fake" stats objects in environments without `fs`. * deps: finalhandler@0.3.6. - deps: debug@ 2.2.0. - deps: on-finished@ 2.2.1. * deps: on-finished@ 2.2.1. - Fix `isFinished(req)` when data buffered. * deps: proxy-addr@ 1.0.8. - deps: ipaddr.js@1.0.1. * deps: qs@2.4.2. - Fix allowing parameters like `constructor`. * deps: send@0.12.3. - deps: debug@ 2.2.0. - deps: depd@ 1.0.1. - deps: etag@ 1.6.0. - deps: ms@0.7.1. - deps: on-finished@ 2.2.1. * deps: serve-static@ 1.9.3. - deps: send@0.12.3. * deps: type-is@ 1.6.2. - deps: mime-types@ 2.0.11.
4.12.318 Mar 2015 08:45 minor feature: deps: accepts@ 1.2.5. deps: mime-types@ 2.0.10. deps: debug@ 2.1.3. Fix high intensity foreground color for bold. deps: ms@0.7.0. deps: finalhandler@0.3.4. deps: debug@ 2.1.3. deps: proxy-addr@ 1.0.7. deps: ipaddr.js@0.1.9. deps: qs@2.4.1. Fix error when parameter `hasOwnProperty` is present. deps: send@0.12.2. Throw errors early for invalid `extensions` or `index` options. deps: debug@ 2.1.3. deps: serve-static@ 1.9.2. deps: send@0.12.2. deps: type-is@ 1.6.1. deps: mime-types@ 2.0.10.
4.12.102 Mar 2015 13:45 minor feature: Fix constructing application with non-configurable prototype properties Fix `ECONNRESET` errors from `res.sendFile` usage Fix `req.host` when using "trust proxy" hops count Fix `req.protocol`/`req.secure` when using "trust proxy" hops count Fix wrong `code` on aborted connections from `res.sendFile` deps: merge-descriptors@1.0.0
4.12.024 Feb 2015 08:25 minor feature: Fix `"trust proxy"` setting to inherit when app is mounted. Generate `ETag`s for all request responses. No longer restricted to only responses for `GET` and `HEAD` requests. Use `content-type` to parse `Content-Type` headers. deps: accepts@ 1.2.4. Fix preference sorting to be stable for long acceptable lists. deps: mime-types@ 2.0.9. deps: negotiator@0.5.1. deps: cookie-signature@1.0.6. deps: send@0.12.1. Always read the stat size from the file. Fix mutating passed-in `options`. deps: mime@1.3.4. deps: serve-static@ 1.9.1. deps: send@0.12.1. deps: type-is@ 1.6.0. fix argument reassignment. fix false-positives in `hasBody` `Transfer-Encoding` check. support wildcard for both type and subtype . deps: mime-types@ 2.0.9.
4.11.203 Feb 2015 17:05 minor feature: Fix `res.redirect` double-calling `res.end` for `HEAD` requests deps: accepts@ 1.2.3 deps: mime-types@ 2.0.8 deps: proxy-addr@ 1.0.6 deps: ipaddr.js@0.1.8 deps: type-is@ 1.5.6 deps: mime-types@ 2.0.8
4.11.122 Jan 2015 10:45 minor feature: deps: send@0.11.1 Fix root path disclosure deps: serve-static@ 1.8.1 Fix redirect loop in Node.js 0.11.14 Fix root path disclosure deps: send@0.11.1
4.11.018 Jan 2015 07:45 minor feature: Add `res.append` to append headers Deprecate leading `:` in `name` for `app.param` Deprecate `req.param` -- use `req.params`, `req.body`, or `req.query` instead Deprecate `app.param` Fix `OPTIONS` responses to include the `HEAD` method properly Fix `res.sendFile` not always detecting aborted connection Match routes iteratively to prevent stack overflows deps: accepts@ 1.2.2 deps: mime-types@ 2.0.7 deps: negotiator@0.5.0 deps: send@0.11.0 deps: debug@ 2.1.1 deps: etag@ 1.5.1 deps: ms@0.7.0 deps: on-finished@ 2.2.0 deps: serve-static@ 1.8.0 deps: send@0.11.0
4.10.814 Jan 2015 18:05 minor feature: Fix crash from error within `OPTIONS` response handler deps: proxy-addr@ 1.0.5 deps: ipaddr.js@0.1.6
4.10.705 Jan 2015 05:55 minor feature: Fix `Allow` header for `OPTIONS` to not contain duplicate methods Fix incorrect "Request aborted" for `res.sendFile` when `HEAD` or 304 deps: debug@ 2.1.1 deps: finalhandler@0.3.3 deps: debug@ 2.1.1 deps: on-finished@ 2.2.0 deps: methods@ 1.1.1 deps: on-finished@ 2.2.0 deps: serve-static@ 1.7.2 Fix potential open redirect when mounted at root deps: type-is@ 1.5.5 deps: mime-types@ 2.0.7
4.10.512 Dec 2014 07:45 minor feature: Fix `res.send` double-calling `res.end` for `HEAD` requests deps: accepts@ 1.1.4 deps: mime-types@ 2.0.4 deps: type-is@ 1.5.4 deps: mime-types@ 2.0.4
4.10.324 Nov 2014 03:16 minor feature: Fix `res.sendFile` logging standard write errors deps: etag@ 1.5.1 deps: proxy-addr@ 1.0.4 deps: ipaddr.js@0.1.5 deps: qs@2.3.3 Fix `arrayLimit` behavior
4.10.210 Nov 2014 03:19 minor feature: Correctly invoke async router callback asynchronously deps: accepts@ 1.1.3 deps: mime-types@ 2.0.3 deps: type-is@ 1.5.3 deps: mime-types@ 2.0.3
4.10.130 Oct 2014 16:05 minor bugfix: Fix handling of URLs containing `://` in the path. Fix parsing of mixed objects and values.