Backlog for next releases

[UlisesGascon]

This is the current releases backlog in terms of status and priorities

Important notes:

• The state of the backlog is always reflected in the latest edition of this message.
• Packages and releases are prioritized based on user impact, with security updates and hotfixes considered the most critical.
• Some packages require maintenance releases, as it has been several years since their last update. These items are considered low priority.
• Ideally, each release has a clear leader.

Security Releases (Highest priority)

We intentionally do not disclose more details. This helps us organize the backlog more effectively, as not everyone is aware of which security patches are currently in progress.

• body-parser (repo, npm)
  • semver-patch: GHSA-wqch-xfxh-vrr4
  • 2.2.1: Release: 2.2.1 body-parser#659
• express (repo, npm)
  • semver-minor: GHSA-pj86-cfqh-vqx6
  • release: Release: 4.22.0 express#6921
  • release: Release: 5.2.0 express#6920
• multiparty (repo, npm)
  • semver-minor: https://github.com/pillarjs/multiparty/security/advisories/GHSA-65x3-rw7q-gx94

This is organized in a specific order to ensure we apply patches on the latest versions. For example, Express depends on body-parser.

High Priority

The community is waiting for these releases, which contain patches and features that we need to ship soon.

• cors (repo, npm)
  • Priority: Operational issues with CORS cors#346
  • Lead: @UlisesGascon / @efekrskl
• compressible (repo, npm):
  • Proposal 2.0.19: Release: 2.0.19 jshttp/compressible#32
  • Lead: @UlisesGascon
• on-finished (repo, npm):
  • semver-major: Release Proposal: on-finished@3.0.0 jshttp/on-finished#57
  • Lead: @Phillip9587 / @UlisesGascon
• mime-db (repo, npm):
  • Backlog: Backlog for Release 1.55.0 jshttp/mime-db#414
  • Create a release proposal PR
  • Lead: @UlisesGascon
• iconv-lite (repo, npm):
  • Release: release: 0.7.1 pillarjs/iconv-lite#359
  • Release: 1.x (TBC)
  • Lead: @bjohansebas
• content-disposition (repo, npm):
  • Proposal 1.0.1: Release: 1.0.1 jshttp/content-disposition#58
  • Lead: @Phillip9587 / @UlisesGascon
• mime-types (repo, npm):
  • Proposal 3.0.2 Release: 3.0.2 jshttp/mime-types#169
  • Lead: @UlisesGascon
• http-errors (repo, npm):
  • Motivation: This would deduplicate the statuses package in our dependency tree: npm graph
  • Proposal 2.0.1 Release: 2.0.1 jshttp/http-errors#140
  • Lead: @UlisesGascon
• serve-static (repo, npm)
  • Lead: @UlisesGascon
  • Priority: deps: send@~0.19.1 serve-static#227
  • Release: Release: 2.2.1 serve-static#228
  • Release: Release: 1.16.3 serve-static#229
• send (repo, npm)
  • Lead: @UlisesGascon
  • Priority: deps: use tilde notation and update certain dependencies pillarjs/send#279
  • Release: Release: 1.2.1 pillarjs/send#281
  • Release: Release: 0.19.2 pillarjs/send#280
• finalhandler (repo, npm)
  • Lead: @UlisesGascon
  • Priority: deps: use tilde notation and update certain dependencies pillarjs/finalhandler#118 and fix: update engines reference in the pkg pillarjs/finalhandler#119
  • Release: Release: 2.1.1 pillarjs/finalhandler#120
  • Release: Release: 1.3.2 pillarjs/finalhandler#121
• body-parser (repo, npm)
  • Lead: @UlisesGascon
  • Priority: deps: use tilde notation and update certain dependencies body-parser#668
  • Release: Release: 1.20.4 body-parser#672
  • 2.2.2: Release: 2.2.2 body-parser#691
• cookie (repo, npm)
  • Lead: @blakeembrey
  • cookie@1.1.0: https://github.com/jshttp/cookie/releases/tag/v1.1.0

Medium Priority

The community is waiting for these releases, which include patches and features that we can release without urgency. In some cases, the release backlog is not yet ready.

• multer (repo, npm):
  • semver-major and semver-patch pending: Releases Backlog (2.1.0 and 3.0.0) multer#1310
  • Lead: @bjohansebas / @UlisesGascon / @LinusU
• compression (repo, npm):
  • semver-major: Compression v2 compression#234
  • Lead: @bjohansebas / @UlisesGascon
• express-session (repo, npm):
  • semver-major: backlog for express-session@2.x session#1006
  • Lead: @UlisesGascon / @bjohansebas
• response-time (repo, npm)
  • semver-major: Discussion: Proposed Changes for expressjs/response-time Next Major Version response-time#25
  • Lead: @carpasse / @UlisesGascon
• basic-auth-connect (repo, npm):
  • semver-major: Backlog: Release v2.0 basic-auth-connect#8
  • Lead: @UlisesGascon
• hbs (repo, npm)
  • semver-major: https://github.com/pillarjs/hbs/tree/5.0
  • Lead: @UlisesGascon / @mfdebian
• on-headers (repo, npm):
  • semver-major: on-headers v2 jshttp/on-headers#18
  • Lead: @bjohansebas / @UlisesGascon
• content-type (repo, npm):
  • semver-major: v2.0.0 - Major Release (Proposal) jshttp/content-type#27
  • Lead: @Phillip9587 / @UlisesGascon
• basic-auth (repo, npm):
  • semver-major: basic-auth v3 - Proposal jshttp/basic-auth#70
  • Lead: @Phillip9587 / @UlisesGascon
• errorhandler (repo, npm)
  • Lead: @UlisesGascon / @nanotower
• cookies (repo, npm)
  • semver-major proposal: 1.0.0 pillarjs/cookies#48
  • Lead: @UlisesGascon / @imangas
• http-assert (repo, npm)
  • Motivation: Update http-errors to v2 jshttp/http-assert#37
  • Lead: @UlisesGascon

Backlog

We need to plan the release content. These releases are considered blocked until we gain more traction.

• serve-index (repo, npm)
• method-override (repo, npm)
• vhost (repo, npm)
• parseurl (repo, npm)
• csrf (repo, npm)
• resolve-path (repo, npm)
• media-typer (repo, npm)
• vary (repo, npm)
• methods (repo, npm)
• range-parser (repo, npm)
• proxy-addr (repo, npm)
• etag (repo, npm)
• http-errors (repo, npm)
• forwarded (repo, npm)
  • semver-major proposal: v1.0.0-rc.1 jshttp/forwarded#1

On hold

We released a version recently, but we can prepare a new one containing the remaining open issues, dependency upgrades, and other improvements.

• morgan (repo, npm)
• serve-favicon (repo, npm)
• connect-timeout (repo, npm)
• statuses (repo, npm)
• fresh (repo, npm)
• negotiator (repo, npm)
• type-is (repo, npm)
• encodeurl (repo, npm)
• iconv-lite (repo, npm)
• router (repo, npm)
• cookie-parser (repo, npm)
• cookie-session (repo, npm)
• path-to-regexp (repo, npm)

[bjohansebas]

For multer@2 mainly, it remains to switch to CommonJS, update the dependencies, and move support to Node >=18

compression@2 while some PRs have been reviewed, the main one is still not finished (expressjs/compression#183). If anyone can help us, that would be great. A beta will be launched when (expressjs/compression#153 and expressjs/compression#232) are merged.

on-finished@3 I’m going to work on HTTP2 support, since this will also depend on compression@2 and the goal of releasing Express v6 with HTTP2.

on-headers I think we’re going to release a new major version, dropping support for the old Node.js versions and adding support for HTTP2, which is also essential for compression@2

I think I’m not forgetting anything else from the packages I’m working on or that depend on my changes

[UlisesGascon]

@bjohansebas can you create the backlog issues for multer@2 and compression@2? Thanks for taking the leaderhip ❤️

[bjohansebas]

compression v2: expressjs/compression#234
multer v2: expressjs/multer#1310
on-headers v2: jshttp/on-headers#18

[inidaname]

For a new Express contributor, how would one go about helping out here?

[bjohansebas]

Hi @inidaname! We have this guide for doing triage in the repositories. I recommend you pick a repository and take a look at the existing issues, or check out the current PRs

[aqeelat]

I would like to help cut releases for some of these packages (esp ones under jshttp). I know I don't have credibility with the expressjs maintainers; how can I get involved?

From a quick glance, most of the changes needed are dependency upgrades.
I can also help create an nx monorepo and help core devs migrate the packages to it.

[Phillip9587]

Hey everyone,

I just wanted to bring this back to your attention. Summer officially ended on 2025-09-22 (astronomically speaking), so this might be a good time to push out a few more of the originally planned releases.

In particular i think the community could benefit of the following releases:

• http-errors (repo, npm): This would deduplicate the statuses package in our dependency tree: npm graph
• body-parser: (repo, npm): Release Proposal 2.2.1 body-parser#644
• content-disposition (repo, npm): Release: 1.0.1 jshttp/content-disposition#58

[UlisesGascon]

I just updated the main issue with the current backlog (cc: @bjohansebas @Phillip9587 @carpasse @mfdebian )

#380 (comment)

If you see something that does not make sense, or you want to delegate some work let me know here or in slack 👍

I hope this finally makes more clear where we are and what is going to happen next. I also included a mention to the future security releases so it is easier to plan also outside of the @expressjs/security-triage (cc: @expressjs/express-tc )