Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Release Plan: 5.1.0 #6316

Closed
55 of 68 tasks
wesleytodd opened this issue Feb 3, 2025 · 14 comments
Closed
55 of 68 tasks

Release Plan: 5.1.0 #6316

wesleytodd opened this issue Feb 3, 2025 · 14 comments
Labels
5.x

Comments

@wesleytodd
Copy link
Member

wesleytodd commented Feb 3, 2025 •
edited
Loading

Remaining Work

Dependency work

Not planned for this release
@jonchurch jonchurch mentioned this issue Feb 3, 2025
Closed
@dpopp07
Copy link
Contributor

dpopp07 commented Feb 3, 2025

I'm happy to open a small PR with the semver range changes.

@dpopp07 dpopp07 mentioned this issue Feb 3, 2025
Merged
@bjohansebas bjohansebas added the 5.x label Feb 5, 2025
@jonchurch jonchurch mentioned this issue Feb 17, 2025
Closed
@dpopp07
Copy link
Contributor

dpopp07 commented Feb 20, 2025 •
edited
Loading

PR to address router issue: pillarjs/router#151

Edit: sibling PR to the above for documenting the router change in the migration guide: expressjs/expressjs.com#1819

@dpopp07 dpopp07 mentioned this issue Mar 4, 2025
Closed
@c100k c100k mentioned this issue Mar 11, 2025
Closed
@bjohansebas bjohansebas mentioned this issue Mar 18, 2025
Merged
@UlisesGascon
Copy link
Member

UlisesGascon commented Mar 23, 2025 •
edited by wesleytodd
Loading

Ok, so following #6412 my current understanding of the release plan and the blockers is the following (@wesleytodd please edit this 🙏 ). Also I was fishing some items from expressjs/discussions#266

Current proposal

What's Changed

New Contributors

Full Changelog: 5.0.1...master

Pending Work

Express Work

Potential additions
What do you think @wesleytodd? Maybe we can include them while unblocking other parts?

Final Work

  • Prepare a PR with the version bump to 5.1.0 and the full changelog (@wesleytodd )
  • Create a github release and a git tag for 5.1.0 (@wesleytodd )
  • Publish the version in npm (@wesleytodd)
  • Social Media promotion (@wesleytodd )

Dependencies

Level 0 (Express itself)

Level 1

Level 2

Level 3

Level 4

@bjohansebas
Copy link
Member

Btw, the change of engines in path-to-regexp needs to be a major release.

@UlisesGascon
Copy link
Member

Btw, the change of engines in path-to-regexp needs to be a major release.

True! actually if we want to go with 9.0.0 is a good option, otherwise I can revert the commit partially to be semver compatible. WDYT (@bjohansebas @wesleytodd ) ?

@bjohansebas
Copy link
Member

I think we should stick to version 8. I don't think we should release another version of path-to-regexp unless we want to make other types of changes (such as releasing a dual package (commonjs and ems), moving to ESM, or achieving safer regex for string patterns).

@jonkoops
Copy link
Contributor

What is the ESM transition plan for these dependencies (if any)? In April, support for Node.js 18 will be dropped, which is the last version of Node.js that does not support interoperability between CommonJS and ESM. So technically, that would be a good moment to raise the minimum version and do a full ESM conversion. If you are short on hands for this effort, I can volunteer my time to get it done, if so desired.

@panva
Copy link

panva commented Mar 24, 2025

Is 5.1.0 going to be tagged as @latest on npm?

@bjohansebas
Copy link
Member

Yes, 5.1.0 will be the latest version when it is released

@panva
Copy link

panva commented Mar 24, 2025 •
edited
Loading

That's good to know, issues spanning from req.host not being an actual url host component (i.e. incl. port) will go away as people slowly upgrade. So far with v5 being tagged as @next it was hard to get people to upgrade.

@wesleytodd
Copy link
Member Author

What is the ESM transition plan for these dependencies

@jonkoops, you can read more about that here: expressjs/discussions#323

Is 5.1.0 going to be tagged as @latest on npm?

express and all of it's direct dependents we had kept at next while express was will be going latest.

That's good to know, issues spanning from req.host not being an actual url host component (i.e. incl. port) will go away as people slowly upgrade. So far with v5 being tagged as @next it was hard to get people to upgrade.

@panva Do you have some node issues I can link to when we talk about this? It is near impossible to get folks to upgrade even if it is latest but we can try with good messaging.

@bjohansebas bjohansebas changed the title [WIP] Release Plan: 5.1.0 Release Plan: 5.1.0 Mar 27, 2025
@panva
Copy link

panva commented Mar 27, 2025 •
edited
Loading

Do you have some node issues I can link to when we talk about this? It is near impossible to get folks to upgrade even if it is latest but we can try with good messaging.

@wesleytodd Having express as a dependency of a passport strategy - it is a real struggle to be able to determine the request's original href without both replicating express' internals and changing the resolution code based on the app's trust proxy setting. This is stemming from the fact that req.host in v4 is the hostname and not the host and there's no host getter that would take trust proxy into consideration.

refs: panva/openid-client#767, panva/openid-client#743, panva/openid-client#733, panva/openid-client#746, panva/openid-client#713, panva/openid-client#714

v5 behaves as expected but unfortunately in v4 the code doesn't work for development on localhost with arbitrary ports, and in production with non http scheme default ports (i.e. other than 80 and 443).

I've resisted the pressure of accomodating the bugged v4 behaviour and just explained to users they need to either upgrade to v5 or overload the method that returns the current URL in development setups. In v4 the req.host should have been fixed instead of being deprecated and console warned upon use in the first place. I get a few issues opened every now and then because of it.

It is near impossible to get folks to upgrade even if it is latest but we can try with good messaging.

I get that. But at least having latest be v5 means new apps will default to v5 with npm i express and the transition to v5 can begin for real in userland.

@jonkoops
Copy link
Contributor

@jonkoops, you can read more about that here: expressjs/discussions#323

Thanks, I will subscribe there 👍

@wesleytodd
Copy link
Member Author

Proposed release: #6425

I will close this in favor of moving any conversation there now that we have a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
5.x
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@panva @jonkoops @wesleytodd @UlisesGascon @dpopp07 @bjohansebas