express: Express v5 blockers

I started writing this as a reply to https://github.com/expressjs/express/issues/4920#issuecomment-1575599117 but the issue was locked just before I finishing typing my comment.

@dougwilson Thanks for your continued work on express. I’m sorry you’ve had to deal with reports of bogus security vulnerabilities as well as folks who don’t know better assuming that you’ve abandoned the project. I hope it doesn’t get you down. ❤️

I do have a question re:

reach out and I would be happy to Zoom with you or similar and we can work on the remaining items together, like see what you want to help with or hear what there is and you can let me know what you can do.

Are you open to the idea of enumerating the remaining work to be done in public, rather than in private Zoom calls, e.g. on this issue or another one?

It may seem like asking folks to get on a Zoom call is not a big ask, but time zones and other factors could make that a nontrivial barrier. Moreover, documenting this in a public issue would eliminate the need for repeating yourself over N Zoom calls.

The last update said:

Express 5 is pretty much completed at this point, and we’re just finishing up the last code merges in upstream modules in order to bump the dependencies finally in the 5.0 branch.

If this is still the case, perhaps you could provide more details about which modules are currently blocked and link to any relevant PRs/issues that are stalled. Even if you’d still prefer to for folks that want to help to first reach out to you, providing this additional detail could help to make those conversations more fruitful.

Anyway, just wanted to pose the question for you to consider. Once again, thanks for your continued work on express and I hope you are doing well!

About this issue

  • Original URL
  • State: open
  • Created a year ago
  • Reactions: 26
  • Comments: 30 (10 by maintainers)

Most upvoted comments

Hi @rmacklin sorry about that, I didn’t think there would have been any more real replies, and it was quite out of date anyway, so your new issue is probably for the best. I can certainly work on writing it down. I just suggested Zoom would be easier because it is fast and a conversation. I will need to take some time to gather everything, and will of course no longer be working on Express.js code while I do that. It seems like that is what folks want to see, however, so I think that working on documenting everything out is a higher priority than working on the code at this point. Please let me know if I’m mistaken. I have never been great about documenting these things down in writing, and it is a huge weakness of mine; I am more of a code writer, lol. So please forgive me. I would love it if someone who has that as their strong suit would join to help ‘fish’ it out of me, lol.

Yes, that is the next step, to make it rc. Unless there are comtribs to add anything more, I plan to just run the train to get it out. There are a lot of changes between 4 and 5 especially with route path matching I hoped bugs would get flushed out before marked rc was all.

I am an old fart, but back in the day, beta was for working out all the breaking changes and making it work reasonably well with no crashes. And there will be a 5.1, so if you like where the product is at, RC it. And thanks for all your hard work!!!

Doug, I’d like to add to the many thanks for maintaining this project.

Sure, I can make a RC instead of the final if that is what you want. I just want to do whatever people want, and if you want me to release the above as a RC first and then wait more for testing, I can definitely do that 👍

With this many years of baking, I’d suggest releasing 5.0 final. That way people can start using this, and submitting PRs if they find anything (any bugs). Thanks!

Maybe an Express 5 Christmas Present? 😄

@soulchild Express types are currently maintained in https://github.com/DefinitelyTyped/DefinitelyTyped and not part of the express repository. Once express 5 is released, we can make a PR to update @types/express. We can also add native types as 5.1 or similar, since it’s not a breaking change, but IMO it’s important we release express 5.0 as soon as possible so that dependent libraries and types can be updated by other maintainers.

Edit: also, btw, in the interim, you can totally use express@5 with @types/express@4.17. I’ve been using that for a while and it’s working fine. The slight mismatch doesn’t stop you from compiling your typescript, but might aggravate your linter a little. I’m using the following type patch:

declare module "express-serve-static-core" {
  export interface RequestHandler<
    P = ParamsDictionary,
    ResBody = any,
    ReqBody = any,
    ReqQuery = ParsedQs,
    LocalsObj extends Record<string, any> = Record<string, any>,
  > {
    (
      req: Request<P, ResBody, ReqBody, ReqQuery, LocalsObj>,
      res: Response<ResBody, LocalsObj>,
      next: NextFunction,
      // This is the only line that's different from the original type
    ): void | Promise<void>;
  }
}

Yea, definitely, we can always accept bugs and features, just not breaking changes of course as much as possible. And of course just any change in behavior in 5 compared to 4 is not a bug 😃 just putting that out there as that is what went on with the 3 to 4 era, people would call changes between the two bugs and wanted to revert or change in some additional breaking way. I don’t think we should have any ones like that this time; most of the routing changes are bc 5 now follows the URLPattern spec I would think.

I tried to add error-handling middleware to a web application recently, found out that it doesn’t work with async request handlers, and fell down this rabbit hole.

Express 5.0’s release date has been continually pushed back since 2015; it seems like people have been told that 5.0’s release is just around the corner for the last 8-9 years.

Are there any specific tasks - code, documentation, triaging, etc. - that others can help out with in order to get 5.0 out the door? I understand that you have no specific obligations since this is volunteer work, but it seems like many others are willing to help out with this if they can get an up-to-date roadmap. I’m not sure when the 5.0 milestone or #2237 were last updated, or to what extent they accurately reflect the work left to do.

If it’s lack of usage that’s blocking the release, you’re going to be waiting forever–very few people want to use beta software in production, and it becomes a catch-22 of not wanting to release until more people have used 5.0, but people not wanting to use 5.0 until it’s a stable release.

If there’s any info on what people can do to help (e.g. what documentation needs to be written, what bugs need to be fixed, what features need to be implemented), I think it’d go a long way towards helping people both understand and help out with 5.0.

It is difficult to make promises for timelines as this is just voluntary work. I am triaging some security reports currently which take the highest priority so that’s ultimately the most I can promise in time frame. If these pan in to actual security issues I would say that whatever the next 5 release is is going to be RC.

Hey @melroy89 (and others in this thread), if you are interested in participating we have been working on getting the project back on track. Check out the initial plan here and our top priorities we put on the TC agenda.

Sorry about that. I am happy to use my time to write those things down instead of do them if you like. I am admittedly not the best at writing it down, and just typing this from my phone while at work right now, and planned to work on the cookie changes for a 4.x release people need for some Chrome change, so probably a little lower on my list. I figured once I publish that 4 release, I would merge it into the 5 branch and just publish that as 5.0 in the end. Not sure if that helps at all.

Edit: If anyone wanted to see something in 5.0 that is not in the beta, I guess speak now or forever hold your peace 😃 especially if the way all the new routing works doesn’t work well, well, obviously whay is 5.0 will be 5.0, as no breaking changes again until 6.0

I really really wish we will get Express v5 in 2024.

the latest v5 was release from 2022, and now it’s 2024.

I’ve been using express version 5, trying to put it through its paces. looks good so far. Ready to merge it and release it?

@dougwilson I’m looking forward to seeing Express 5 released ❤️

I concur. Software is never really done. It’s alive.

Serious questions, if 5.0 is basically finished, why is it still in Beta? Maybe time to bump it to RC? I have so much on my plate, I don’t have time to test a beta. But more than willing to test an RC version. I just want to know if the interface is set. I know sometimes you have to slide in an interface change, but it would be nice to know that you “think” the interface is stable.