Express.js v5 is here after 10 years!

Summary

After a decade of anticipation, Express.js has officially released version 5, marking a significant milestone for the framework. This release prioritizes stability and security, dropping support for older Node.js versions and simplifying maintenance. Notably, it removes regular expressions to mitigate potential security vulnerabilities. By adopting a 'boring' approach, Express signals its commitment to gradual improvements and sets the stage for future developments. As it re-establishes its prominence in the Node.js ecosystem, the release underscores Express's enduring popularity among developers, promising exciting enhancements ahead.

Takeaways

• 🎉 Express.js version 5 has finally been merged and published after 10 years of development.
• 🛠️ The release aims to be 'boring', focusing on stability and maintainability rather than introducing exciting new features.
• 🕰️ Express's long development period was due to its stable nature and the necessity of robust project governance.
• 🔒 A new security working group has been established to address open-source supply chain security concerns.
• 📉 Version 5 drops support for old Node.js versions, now requiring Node 18 and above, which will enhance performance and maintenance.
• ⚠️ Regular expressions support has been removed to prevent potential security vulnerabilities such as Regular Expression Denial of Service (ReDoS) attacks.
• 📈 Express remains the most popular choice for creating HTTP servers in Node.js, outpacing newer frameworks in npm download statistics.
• 🔍 The minimal breaking changes in version 5 signal a significant step forward for the framework and the community.
• 🔄 Updates to outdated dependencies and improved CI practices are included to ensure a modern development environment.
• 🚀 The future looks promising for Express.js as it reestablishes its position in the ecosystem amidst newer frameworks.

Q & A

What was the timeline for the release of Express.js version 5?

The pull request for Express.js version 5 was opened in July 2014 and was finally merged and published after ten years in 2024.

Why did it take so long to merge the pull request for version 5?

The lengthy timeline is attributed to the need for strong project governance, which is critical for the health of large open-source projects, and the aim to ensure a stable release.

What does the 'boring' release philosophy mean for Express.js version 5?

The 'boring' philosophy means that version 5 intentionally avoids major new features or significant changes to provide stability and to unblock future enhancements for the ecosystem.

What major changes were made in Express.js version 5?

Version 5 drops support for older Node.js versions, now only supporting Node.js 18 and above, to improve performance and maintainability, and it removes subexpressions in regular expressions for security reasons.

What is the significance of dropping support for old Node.js versions?

Dropping support for older Node.js versions allows Express to implement critical performance improvements and maintainability changes, as supporting old versions can hold back progress due to their quirks and limitations.

How does version 5 address security concerns?

Version 5 includes the formation of a security working group and a security triage team to tackle the increasing needs around open-source supply chain attacks and ensure a secure release.

What are ReDoS attacks, and how does version 5 mitigate them?

ReDoS (regular expression denial of service) attacks occur when a regular expression is overly complex, consuming excessive CPU resources. Version 5 mitigates this risk by removing subexpressions in regular expressions.

How does Express.js's popularity compare to other frameworks?

Express.js remains the most downloaded and popular framework for creating HTTP servers in Node.js, outpacing newer frameworks like Fastify and Hono.js in terms of downloads and community adoption.

What does the term 'next' mean in the context of the Express.js release?

The term 'next' indicates that version 5 is not yet the latest stable release available on npm, which remains at version 4.2.1 until further updates are made.

What future developments can be anticipated for Express.js following version 5?

With version 5 now released, users can expect more impactful changes and optimizations in future updates, as the team signals a renewed commitment to developing and enhancing the framework.