From fde8f647d368df1dc62d55ce4d68370ef3eb0a49 Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Wed, 17 May 2017 16:00:49 +0800
Subject: [PATCH 001/479] examples: fix route in params example

closes #3310
---
 examples/params/index.js  | 2 +-
 test/acceptance/params.js | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/params/index.js b/examples/params/index.js
index d70f0beeeb1..f918b5fd30d 100644
--- a/examples/params/index.js
+++ b/examples/params/index.js
@@ -68,7 +68,7 @@ app.get('/users/:from-:to', function(req, res, next){
   var from = req.params.from;
   var to = req.params.to;
   var names = users.map(function(user){ return user.name; });
-  res.send('users ' + names.slice(from, to).join(', '));
+  res.send('users ' + names.slice(from, to + 1).join(', '));
 });
 
 /* istanbul ignore next */
diff --git a/test/acceptance/params.js b/test/acceptance/params.js
index 56b7a72ce0f..e7c30cf7732 100644
--- a/test/acceptance/params.js
+++ b/test/acceptance/params.js
@@ -29,8 +29,8 @@ describe('params', function(){
   describe('GET /users/0-2', function(){
     it('should respond with three users', function(done){
       request(app)
-        .get('/users/0-2')
-        .expect(/users tj, tobi/,done)
+      .get('/users/0-2')
+      .expect(/users tj, tobi, loki/, done)
     })
   })
 

From 60f87f8074c28a1727305530058d8c2c9596387c Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Wed, 17 May 2017 17:04:10 +0800
Subject: [PATCH 002/479] examples: fix posts link in route-separation example

closes #3310
---
 examples/route-separation/views/index.ejs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/route-separation/views/index.ejs b/examples/route-separation/views/index.ejs
index 6d1afb4ac3d..2a0b095fa36 100644
--- a/examples/route-separation/views/index.ejs
+++ b/examples/route-separation/views/index.ejs
@@ -4,7 +4,7 @@
 
 <ul>
   <li>Visit the <a href="/users">users</a> page.</li>
-  <li>Visit the <a href="/users">posts</a> page.</li>
+  <li>Visit the <a href="/posts">posts</a> page.</li>
 </ul>
 
 <% include footer %>

From cf37240e7306c5085f3d2a232a4649279d020667 Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Wed, 17 May 2017 17:10:38 +0800
Subject: [PATCH 003/479] examples: fix reference error in view-constructor

closes #3310
---
 examples/view-constructor/github-view.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/view-constructor/github-view.js b/examples/view-constructor/github-view.js
index 53890291056..0a98a908434 100644
--- a/examples/view-constructor/github-view.js
+++ b/examples/view-constructor/github-view.js
@@ -2,7 +2,7 @@
  * Module dependencies.
  */
 
-var http = require('http');
+var https = require('https');
 var path = require('path');
 var extname = path.extname;
 

From 9f019c8c6966736803a65eb4a96d0e7e87e85ede Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Wed, 17 May 2017 23:55:27 +0800
Subject: [PATCH 004/479] examples: add comment about Redis install in examples

closes #3310
---
 examples/online/index.js  | 6 +++++-
 examples/search/index.js  | 6 +++++-
 examples/session/index.js | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/examples/online/index.js b/examples/online/index.js
index 5cdaa6ca8d2..f14474c08d3 100644
--- a/examples/online/index.js
+++ b/examples/online/index.js
@@ -1,4 +1,8 @@
-// first:
+
+// install redis first:
+// https://redis.io/
+
+// then:
 // $ npm install redis online
 // $ redis-server
 
diff --git a/examples/search/index.js b/examples/search/index.js
index 79f5d9f4d36..246993caa5a 100644
--- a/examples/search/index.js
+++ b/examples/search/index.js
@@ -1,4 +1,8 @@
-// first:
+
+// install redis first:
+// https://redis.io/
+
+// then:
 // $ npm install redis
 // $ redis-server
 
diff --git a/examples/session/index.js b/examples/session/index.js
index de41a77d2c0..9bae48b8d33 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -1,4 +1,8 @@
-// first:
+
+// install redis first:
+// https://redis.io/
+
+// then:
 // $ npm install redis
 // $ redis-server
 

From 9467a392e33ad1575f2d76aad5fc19f9290d6cd6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jun 2017 19:09:25 -0400
Subject: [PATCH 005/479] build: Node.js@7.10

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index b4beea77f36..c9172c302ca 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "4.8"
   - "5.12"
   - "6.10"
-  - "7.9"
+  - "7.10"
 matrix:
   include:
     - node_js: "8.0"
diff --git a/appveyor.yml b/appveyor.yml
index cd4f9d23e5e..9fbc9d39a38 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -8,7 +8,7 @@ environment:
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
     - nodejs_version: "6.10"
-    - nodejs_version: "7.9"
+    - nodejs_version: "7.10"
 cache:
   - node_modules
 install:

From 48777dc37774eaa2c328a1d9bb9541dfa47ca90f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jun 2017 19:12:30 -0400
Subject: [PATCH 006/479] build: mocha@3.4.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 98adaea686a..1788e9ffd16 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "istanbul": "0.4.5",
     "marked": "0.3.6",
     "method-override": "2.3.8",
-    "mocha": "3.4.1",
+    "mocha": "3.4.2",
     "morgan": "1.8.1",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",

From deffce5704913df9e6b00aca5536345610222417 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 Jun 2017 23:47:12 -0400
Subject: [PATCH 007/479] deps: qs@6.5.0

---
 History.md              | 5 +++++
 lib/middleware/query.js | 3 ++-
 package.json            | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 83b439c63e8..36fadc4b990 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: qs@6.5.0
+
 4.15.3 / 2017-05-16
 ===================
 
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index 5f76f8458f0..7e9166947af 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -12,6 +12,7 @@
  * Module dependencies.
  */
 
+var merge = require('utils-merge')
 var parseUrl = require('parseurl');
 var qs = require('qs');
 
@@ -22,7 +23,7 @@ var qs = require('qs');
  */
 
 module.exports = function query(options) {
-  var opts = Object.create(options || null);
+  var opts = merge({}, options)
   var queryparse = qs.parse;
 
   if (typeof options === 'function') {
diff --git a/package.json b/package.json
index 1788e9ffd16..cb37b98a7f5 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.4",
-    "qs": "6.4.0",
+    "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.3",
     "serve-static": "1.12.3",

From bd5951e603c16c1db779a76bc5e500c243f96cf8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 Jun 2017 23:51:18 -0400
Subject: [PATCH 008/479] deps: debug@2.6.8

closes #3286
closes #3337
---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 36fadc4b990..59663eb712d 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: debug@2.6.8
   * deps: qs@6.5.0
 
 4.15.3 / 2017-05-16
diff --git a/package.json b/package.json
index cb37b98a7f5..674c8601ab0 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "content-type": "~1.0.2",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "debug": "2.6.7",
+    "debug": "2.6.8",
     "depd": "~1.1.0",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",

From 1adee79e636400c734f2307c1ef4fb0fff5db92b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 Jun 2017 23:58:01 -0400
Subject: [PATCH 009/479] deps: update example dependencies

---
 package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 674c8601ab0..7f401132cae 100644
--- a/package.json
+++ b/package.json
@@ -58,16 +58,16 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.17.1",
+    "body-parser": "1.17.2",
     "cookie-parser": "~1.4.3",
     "ejs": "2.5.6",
-    "express-session": "1.15.2",
+    "express-session": "1.15.3",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
-    "method-override": "2.3.8",
+    "method-override": "2.3.9",
     "mocha": "3.4.2",
-    "morgan": "1.8.1",
+    "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
     "should": "11.2.1",

From 04beebb2c087e3b9795d6f1c3d0bd1112bf1f244 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 26 Jul 2017 11:52:42 -0400
Subject: [PATCH 010/479] build: Node.js@6.11

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index c9172c302ca..3e899dd2351 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.10"
+  - "6.11"
   - "7.10"
 matrix:
   include:
diff --git a/appveyor.yml b/appveyor.yml
index 9fbc9d39a38..ed8d4aa9f05 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.10"
+    - nodejs_version: "6.11"
     - nodejs_version: "7.10"
 cache:
   - node_modules

From 43dff4ceb3446397aa3fe8c48b2de67b9e76a031 Mon Sep 17 00:00:00 2001
From: Piper Chester <piperchester@users.noreply.github.com>
Date: Tue, 27 Jun 2017 11:48:08 +0200
Subject: [PATCH 011/479] docs: fix GitHub capitalization

closes #3353
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 786756a1cd2..17326615776 100644
--- a/Readme.md
+++ b/Readme.md
@@ -39,7 +39,7 @@ $ npm install express
 
   * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/expressjs/expressjs.com)]
   * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
-  * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
+  * [GitHub Organization](https://github.com/expressjs) for Official Middleware & Modules
   * Visit the [Wiki](https://github.com/expressjs/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion
   * [Gitter](https://gitter.im/expressjs/express) for support and discussion

From 5e16f400f17ca4bac48226446b09299e392db3b2 Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Fri, 19 May 2017 00:18:28 +0800
Subject: [PATCH 012/479] examples: use 1-based visitor count in
 cookie-sessions

closes #3312
---
 examples/cookie-sessions/index.js  | 5 ++---
 test/acceptance/cookie-sessions.js | 6 +++---
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index 73653f63af9..1dda15de612 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -15,9 +15,8 @@ app.use(count);
 
 // custom middleware
 function count(req, res) {
-  req.session.count = req.session.count || 0;
-  var n = req.session.count++;
-  res.send('viewed ' + n + ' times\n');
+  req.session.count = (req.session.count || 0) + 1
+  res.send('viewed ' + req.session.count + ' times\n')
 }
 
 /* istanbul ignore next */
diff --git a/test/acceptance/cookie-sessions.js b/test/acceptance/cookie-sessions.js
index 611ebe462a2..d438cfe6d5d 100644
--- a/test/acceptance/cookie-sessions.js
+++ b/test/acceptance/cookie-sessions.js
@@ -7,7 +7,7 @@ describe('cookie-sessions', function () {
     it('should display no views', function (done) {
       request(app)
       .get('/')
-      .expect(200, 'viewed 0 times\n', done)
+      .expect(200, 'viewed 1 times\n', done)
     })
 
     it('should set a session cookie', function (done) {
@@ -20,12 +20,12 @@ describe('cookie-sessions', function () {
     it('should display 1 view on revisit', function (done) {
       request(app)
       .get('/')
-      .expect(200, 'viewed 0 times\n', function (err, res) {
+      .expect(200, 'viewed 1 times\n', function (err, res) {
         if (err) return done(err)
         request(app)
         .get('/')
         .set('Cookie', getCookies(res))
-        .expect(200, 'viewed 1 times\n', done)
+        .expect(200, 'viewed 2 times\n', done)
       })
     })
   })

From 582381bcebf2a2344e7e054eed9606cc2221dd97 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 26 Jul 2017 13:09:46 -0400
Subject: [PATCH 013/479] deps: proxy-addr@~1.1.5

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 59663eb712d..a724e84231f 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * deps: debug@2.6.8
+  * deps: proxy-addr@~1.1.5
+    - Fix array argument being altered
+    - deps: ipaddr.js@1.4.0
   * deps: qs@6.5.0
 
 4.15.3 / 2017-05-16
diff --git a/package.json b/package.json
index 7f401132cae..daf1f1feb1f 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~1.1.4",
+    "proxy-addr": "~1.1.5",
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.3",

From 3eb16c233c5bf76fb12558101565971372693c73 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 23:30:47 -0400
Subject: [PATCH 014/479] deps: depd@~1.1.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a724e84231f..af2bcfb384c 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * deps: debug@2.6.8
+  * deps: depd@~1.1.1
+    - Remove unnecessary `Buffer` loading
   * deps: proxy-addr@~1.1.5
     - Fix array argument being altered
     - deps: ipaddr.js@1.4.0
diff --git a/package.json b/package.json
index daf1f1feb1f..0a3848134fd 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.8",
-    "depd": "~1.1.0",
+    "depd": "~1.1.1",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",

From b2af1018215540964390aab0c739c1e688865122 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 23:32:44 -0400
Subject: [PATCH 015/479] build: ejs@2.5.7

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0a3848134fd..c14b8126b11 100644
--- a/package.json
+++ b/package.json
@@ -60,7 +60,7 @@
     "after": "0.8.2",
     "body-parser": "1.17.2",
     "cookie-parser": "~1.4.3",
-    "ejs": "2.5.6",
+    "ejs": "2.5.7",
     "express-session": "1.15.3",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",

From daf66beda49ebac6086b81dd1896a34395306a71 Mon Sep 17 00:00:00 2001
From: Hung HOANG <hung.xuan@kellydeli.com>
Date: Thu, 3 Aug 2017 11:33:29 +0200
Subject: [PATCH 016/479] examples: fix path join in ejs example

fixes #3382
closes #3383
closes #3385
---
 examples/ejs/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/ejs/index.js b/examples/ejs/index.js
index b868bdd7cb9..72780912938 100644
--- a/examples/ejs/index.js
+++ b/examples/ejs/index.js
@@ -26,7 +26,7 @@ app.set('views', path.join(__dirname, 'views'));
 
 // Path to our public directory
 
-app.use(express.static(path.join(__dirname + 'public')));
+app.use(express.static(path.join(__dirname, 'public')));
 
 // Without this you would need to
 // supply the extension to res.render()

From 85770a71fc3f3c7f3a1efe3e01d9f0c5fd68f82e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Aug 2017 00:25:59 -0400
Subject: [PATCH 017/479] deps: finalhandler@~1.0.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index af2bcfb384c..c67fd941745 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * deps: debug@2.6.8
   * deps: depd@~1.1.1
     - Remove unnecessary `Buffer` loading
+  * deps: finalhandler@~1.0.4
+    - deps: debug@2.6.8
   * deps: proxy-addr@~1.1.5
     - Fix array argument being altered
     - deps: ipaddr.js@1.4.0
diff --git a/package.json b/package.json
index c14b8126b11..839f370cbcb 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
-    "finalhandler": "~1.0.3",
+    "finalhandler": "~1.0.4",
     "fresh": "0.5.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From e0aa8bf74eed76df4e5cf02005233d9de2401348 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Aug 2017 00:26:50 -0400
Subject: [PATCH 018/479] build: mocha@3.5.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 839f370cbcb..15e80f1934b 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "istanbul": "0.4.5",
     "marked": "0.3.6",
     "method-override": "2.3.9",
-    "mocha": "3.4.2",
+    "mocha": "3.5.0",
     "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",

From 713d2aed93586a7c11fc2c8beeaa0c03c6f565c9 Mon Sep 17 00:00:00 2001
From: Daniel Walasek <lysander6@gmail.com>
Date: Sat, 5 Aug 2017 12:42:45 +0200
Subject: [PATCH 019/479] tests: fix incorrect should usage

closes #3387
---
 test/Route.js                | 14 +++++++-------
 test/Router.js               |  2 +-
 test/app.js                  |  4 ++--
 test/app.param.js            |  6 +++---
 test/app.render.js           |  2 +-
 test/app.routes.error.js     |  8 ++++----
 test/exports.js              |  8 ++++----
 test/req.acceptsEncoding.js  |  6 +++---
 test/req.acceptsEncodings.js |  6 +++---
 test/req.acceptsLanguage.js  | 12 ++++++------
 test/req.acceptsLanguages.js | 12 ++++++------
 test/req.xhr.js              |  8 ++++----
 test/res.sendFile.js         | 14 +++++++-------
 13 files changed, 51 insertions(+), 51 deletions(-)

diff --git a/test/Route.js b/test/Route.js
index ada54086bf0..d7a80bdbc01 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -25,7 +25,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.ok;
+        should(req.called).be.ok()
         done();
       });
     })
@@ -84,7 +84,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.ok;
+        should(req.called).be.ok()
         done();
       });
     })
@@ -104,7 +104,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.true;
+        should(req.called).be.true()
         done();
       });
     })
@@ -156,7 +156,7 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function (err) {
-        should(err).be.ok;
+        should(err).be.ok()
         should(err.message).equal('foobar');
         req.order.should.equal('a');
         done();
@@ -182,7 +182,7 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function (err) {
-        should(err).be.ok;
+        should(err).be.ok()
         should(err.message).equal('foobar');
         req.order.should.equal('a');
         done();
@@ -222,7 +222,7 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function(err){
-        should(err).be.ok;
+        should(err).be.ok()
         err.message.should.equal('boom!');
         done();
       });
@@ -234,7 +234,7 @@ describe('Route', function(){
 
       route.all(function(err, req, res, next){
         // this should not execute
-        true.should.be.false;
+        true.should.be.false()
       });
 
       route.dispatch(req, {}, done);
diff --git a/test/Router.js b/test/Router.js
index 01a6e2c472b..18153d29267 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -47,7 +47,7 @@ describe('Router', function(){
     var router = new Router();
 
     router.use(function (req, res) {
-      false.should.be.true;
+      false.should.be.true()
     });
 
     router.handle({ url: '', method: 'GET' }, {}, done);
diff --git a/test/app.js b/test/app.js
index 941d35ff1cc..e52365c36bb 100644
--- a/test/app.js
+++ b/test/app.js
@@ -86,7 +86,7 @@ describe('in development', function(){
   it('should disable "view cache"', function(){
     process.env.NODE_ENV = 'development';
     var app = express();
-    app.enabled('view cache').should.be.false;
+    app.enabled('view cache').should.be.false()
     process.env.NODE_ENV = 'test';
   })
 })
@@ -95,7 +95,7 @@ describe('in production', function(){
   it('should enable "view cache"', function(){
     process.env.NODE_ENV = 'production';
     var app = express();
-    app.enabled('view cache').should.be.true;
+    app.enabled('view cache').should.be.true()
     process.env.NODE_ENV = 'test';
   })
 })
diff --git a/test/app.param.js b/test/app.param.js
index c7a375418cd..ba43e46f8e3 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -57,13 +57,13 @@ describe('app', function(){
 
       app.get('/post/:id', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number;
+        id.should.be.a.Number()
         res.send('' + id);
       });
 
       app.get('/user/:uid', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number;
+        id.should.be.a.Number()
         res.send('' + id);
       });
 
@@ -91,7 +91,7 @@ describe('app', function(){
 
       app.get('/user/:id', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number;
+        id.should.be.a.Number()
         res.send('' + id);
       });
 
diff --git a/test/app.render.js b/test/app.render.js
index 729b1c97cc8..1485098f582 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -72,7 +72,7 @@ describe('app', function(){
       app.set('view', View);
 
       app.render('something', function(err, str){
-        err.should.be.ok;
+        err.should.be.ok()
         err.message.should.equal('err!');
         done();
       })
diff --git a/test/app.routes.error.js b/test/app.routes.error.js
index 7c49d50ffe2..cbbc23ef574 100644
--- a/test/app.routes.error.js
+++ b/test/app.routes.error.js
@@ -44,10 +44,10 @@ describe('app', function(){
         d = true;
         next();
       }, function(req, res){
-        a.should.be.false;
-        b.should.be.true;
-        c.should.be.true;
-        d.should.be.false;
+        a.should.be.false()
+        b.should.be.true()
+        c.should.be.true()
+        d.should.be.false()
         res.send(204);
       });
 
diff --git a/test/exports.js b/test/exports.js
index d34a7b1cf3e..2a80eedbbe8 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -5,19 +5,19 @@ var should = require('should');
 
 describe('exports', function(){
   it('should expose Router', function(){
-    express.Router.should.be.a.Function;
+    express.Router.should.be.a.Function()
   })
 
   it('should expose the application prototype', function(){
-    express.application.set.should.be.a.Function;
+    express.application.set.should.be.a.Function()
   })
 
   it('should expose the request prototype', function(){
-    express.request.accepts.should.be.a.Function;
+    express.request.accepts.should.be.a.Function()
   })
 
   it('should expose the response prototype', function(){
-    express.response.send.should.be.a.Function;
+    express.response.send.should.be.a.Function()
   })
 
   it('should permit modifying the .application prototype', function(){
diff --git a/test/req.acceptsEncoding.js b/test/req.acceptsEncoding.js
index 12708fc0144..9ed9197829f 100644
--- a/test/req.acceptsEncoding.js
+++ b/test/req.acceptsEncoding.js
@@ -8,8 +8,8 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsEncoding('gzip').should.be.ok;
-        req.acceptsEncoding('deflate').should.be.ok;
+        req.acceptsEncoding('gzip').should.be.ok()
+        req.acceptsEncoding('deflate').should.be.ok()
         res.end();
       });
 
@@ -23,7 +23,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsEncoding('bogus').should.not.be.ok;
+        req.acceptsEncoding('bogus').should.not.be.ok()
         res.end();
       });
 
diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
index c036c297691..aba8ea5fbeb 100644
--- a/test/req.acceptsEncodings.js
+++ b/test/req.acceptsEncodings.js
@@ -8,8 +8,8 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsEncodings('gzip').should.be.ok;
-        req.acceptsEncodings('deflate').should.be.ok;
+        req.acceptsEncodings('gzip').should.be.ok()
+        req.acceptsEncodings('deflate').should.be.ok()
         res.end();
       });
 
@@ -23,7 +23,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsEncodings('bogus').should.not.be.ok;
+        req.acceptsEncodings('bogus').should.not.be.ok()
         res.end();
       });
 
diff --git a/test/req.acceptsLanguage.js b/test/req.acceptsLanguage.js
index b14d920bd69..1c7c5fd86f6 100644
--- a/test/req.acceptsLanguage.js
+++ b/test/req.acceptsLanguage.js
@@ -8,8 +8,8 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsLanguage('en-us').should.be.ok;
-        req.acceptsLanguage('en').should.be.ok;
+        req.acceptsLanguage('en-us').should.be.ok()
+        req.acceptsLanguage('en').should.be.ok()
         res.end();
       });
 
@@ -23,7 +23,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsLanguage('es').should.not.be.ok;
+        req.acceptsLanguage('es').should.not.be.ok()
         res.end();
       });
 
@@ -38,9 +38,9 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res){
-          req.acceptsLanguage('en').should.be.ok;
-          req.acceptsLanguage('es').should.be.ok;
-          req.acceptsLanguage('jp').should.be.ok;
+          req.acceptsLanguage('en').should.be.ok()
+          req.acceptsLanguage('es').should.be.ok()
+          req.acceptsLanguage('jp').should.be.ok()
           res.end();
         });
 
diff --git a/test/req.acceptsLanguages.js b/test/req.acceptsLanguages.js
index 6a9cb3366bc..1d92f44b2b3 100644
--- a/test/req.acceptsLanguages.js
+++ b/test/req.acceptsLanguages.js
@@ -8,8 +8,8 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsLanguages('en-us').should.be.ok;
-        req.acceptsLanguages('en').should.be.ok;
+        req.acceptsLanguages('en-us').should.be.ok()
+        req.acceptsLanguages('en').should.be.ok()
         res.end();
       });
 
@@ -23,7 +23,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsLanguages('es').should.not.be.ok;
+        req.acceptsLanguages('es').should.not.be.ok()
         res.end();
       });
 
@@ -38,9 +38,9 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res){
-          req.acceptsLanguages('en').should.be.ok;
-          req.acceptsLanguages('es').should.be.ok;
-          req.acceptsLanguages('jp').should.be.ok;
+          req.acceptsLanguages('en').should.be.ok()
+          req.acceptsLanguages('es').should.be.ok()
+          req.acceptsLanguages('jp').should.be.ok()
           res.end();
         });
 
diff --git a/test/req.xhr.js b/test/req.xhr.js
index cc8754ce4cf..1bbc247104d 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -8,7 +8,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.xhr.should.be.true;
+        req.xhr.should.be.true()
         res.end();
       });
 
@@ -25,7 +25,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.xhr.should.be.true;
+        req.xhr.should.be.true()
         res.end();
       });
 
@@ -42,7 +42,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.xhr.should.be.false;
+        req.xhr.should.be.false()
         res.end();
       });
 
@@ -59,7 +59,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.xhr.should.be.false;
+        req.xhr.should.be.false()
         res.end();
       });
 
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index be3a23ebc2c..a3576d02196 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -108,7 +108,7 @@ describe('res', function(){
       });
 
       app.use(function (err, req, res, next) {
-        err.code.should.be.empty;
+        err.code.should.be.empty()
         cb();
       });
 
@@ -224,7 +224,7 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
-            should(err).be.ok;
+            should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
             cb();
           });
@@ -243,7 +243,7 @@ describe('res', function(){
       app.use(function (req, res) {
         onFinished(res, function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
-            should(err).be.ok;
+            should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
             cb();
           });
@@ -294,7 +294,7 @@ describe('res', function(){
 
       app.use(function (req, res) {
         res.sendFile(path.resolve(fixtures, 'does-not-exist'), function (err) {
-          should(err).be.ok;
+          should(err).be.ok()
           err.status.should.equal(404);
           res.send('got it');
         });
@@ -348,7 +348,7 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendfile('test/fixtures/name.txt', function (err) {
-            should(err).be.ok;
+            should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
             cb();
           });
@@ -367,7 +367,7 @@ describe('res', function(){
       app.use(function (req, res) {
         onFinished(res, function () {
           res.sendfile('test/fixtures/name.txt', function (err) {
-            should(err).be.ok;
+            should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
             cb();
           });
@@ -600,7 +600,7 @@ describe('res', function(){
       });
 
       app.use(function (err, req, res, next) {
-        err.code.should.be.empty;
+        err.code.should.be.empty()
         cb();
       });
 

From 56e90e3c7267782febe35754806ce3f63b527485 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 5 Aug 2017 23:37:39 -0400
Subject: [PATCH 020/479] lint: add eslint rules that cover editorconfig

---
 .eslintignore                          |  2 ++
 .eslintrc                              |  7 +++++++
 .travis.yml                            |  4 +++-
 appveyor.yml                           |  1 +
 examples/content-negotiation/db.js     |  2 +-
 examples/mvc/controllers/main/index.js |  2 +-
 examples/mvc/db.js                     |  2 +-
 examples/resource/index.js             |  2 +-
 examples/route-separation/site.js      |  2 +-
 examples/search/public/client.js       |  2 +-
 examples/static-files/public/js/app.js |  2 +-
 examples/web-service/index.js          |  2 +-
 package.json                           |  2 ++
 test/acceptance/error-pages.js         |  2 +-
 test/acceptance/error.js               |  2 +-
 test/acceptance/route-map.js           |  2 +-
 test/app.engine.js                     |  4 ++--
 test/config.js                         | 12 ++++++------
 18 files changed, 34 insertions(+), 20 deletions(-)
 create mode 100644 .eslintignore
 create mode 100644 .eslintrc

diff --git a/.eslintignore b/.eslintignore
new file mode 100644
index 00000000000..62562b74a3b
--- /dev/null
+++ b/.eslintignore
@@ -0,0 +1,2 @@
+coverage
+node_modules
diff --git a/.eslintrc b/.eslintrc
new file mode 100644
index 00000000000..8f51db362e8
--- /dev/null
+++ b/.eslintrc
@@ -0,0 +1,7 @@
+{
+  "rules": {
+    "eol-last": "error",
+    "indent": ["error", 2, { "SwitchCase": 1 }],
+    "no-trailing-spaces": "error"
+  }
+}
diff --git a/.travis.yml b/.travis.yml
index 3e899dd2351..5926ca5650a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -27,5 +27,7 @@ before_install:
   # Update Node.js modules
   - "test ! -d node_modules || npm prune"
   - "test ! -d node_modules || npm rebuild"
-script: "npm run-script test-ci"
+script:
+  - "npm run test-ci"
+  - "npm run lint"
 after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"
diff --git a/appveyor.yml b/appveyor.yml
index ed8d4aa9f05..9863c08e272 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -22,4 +22,5 @@ test_script:
   - node --version
   - npm --version
   - npm run test-ci
+  - npm run lint
 version: "{build}"
diff --git a/examples/content-negotiation/db.js b/examples/content-negotiation/db.js
index 8def2f5ad21..43fb04baa18 100644
--- a/examples/content-negotiation/db.js
+++ b/examples/content-negotiation/db.js
@@ -4,4 +4,4 @@ users.push({ name: 'Tobi' });
 users.push({ name: 'Loki' });
 users.push({ name: 'Jane' });
 
-module.exports = users;
\ No newline at end of file
+module.exports = users;
diff --git a/examples/mvc/controllers/main/index.js b/examples/mvc/controllers/main/index.js
index 83db90f6f20..031862d345e 100644
--- a/examples/mvc/controllers/main/index.js
+++ b/examples/mvc/controllers/main/index.js
@@ -1,3 +1,3 @@
 exports.index = function(req, res){
   res.redirect('/users');
-};
\ No newline at end of file
+};
diff --git a/examples/mvc/db.js b/examples/mvc/db.js
index 565fdfaa507..c992afcfd74 100644
--- a/examples/mvc/db.js
+++ b/examples/mvc/db.js
@@ -11,4 +11,4 @@ var users = exports.users = [];
 
 users.push({ name: 'TJ', pets: [pets[0], pets[1], pets[2]], id: 0  });
 users.push({ name: 'Guillermo', pets: [pets[3]], id: 1 });
-users.push({ name: 'Nathan', pets: [], id: 2 });
\ No newline at end of file
+users.push({ name: 'Nathan', pets: [], id: 2 });
diff --git a/examples/resource/index.js b/examples/resource/index.js
index 9137167cdf9..0c2a7a32079 100644
--- a/examples/resource/index.js
+++ b/examples/resource/index.js
@@ -75,7 +75,7 @@ app.resource('/users', User);
 
 app.get('/', function(req, res){
   res.send([
-      '<h1>Examples:</h1> <ul>'
+    '<h1>Examples:</h1> <ul>'
     , '<li>GET /users</li>'
     , '<li>GET /users/1</li>'
     , '<li>GET /users/3</li>'
diff --git a/examples/route-separation/site.js b/examples/route-separation/site.js
index 698892cc89c..a3d20bc8a1f 100644
--- a/examples/route-separation/site.js
+++ b/examples/route-separation/site.js
@@ -1,3 +1,3 @@
 exports.index = function(req, res){
   res.render('index', { title: 'Route Separation Example' });
-};
\ No newline at end of file
+};
diff --git a/examples/search/public/client.js b/examples/search/public/client.js
index 0c198cc39fa..a7eeb6a75af 100644
--- a/examples/search/public/client.js
+++ b/examples/search/public/client.js
@@ -10,4 +10,4 @@ search.addEventListener('keyup', function(){
     }
   };
   xhr.send();
-}, false);
\ No newline at end of file
+}, false);
diff --git a/examples/static-files/public/js/app.js b/examples/static-files/public/js/app.js
index 19102815663..257cc5642cb 100644
--- a/examples/static-files/public/js/app.js
+++ b/examples/static-files/public/js/app.js
@@ -1 +1 @@
-foo
\ No newline at end of file
+foo
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 694e121d91b..41747cfdc7f 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -61,7 +61,7 @@ var users = [
 ];
 
 var userRepos = {
-    tobi: [repos[0], repos[1]]
+  tobi: [repos[0], repos[1]]
   , loki: [repos[1]]
   , jane: [repos[2]]
 };
diff --git a/package.json b/package.json
index 15e80f1934b..9f38f52bc1a 100644
--- a/package.json
+++ b/package.json
@@ -61,6 +61,7 @@
     "body-parser": "1.17.2",
     "cookie-parser": "~1.4.3",
     "ejs": "2.5.7",
+    "eslint": "2.13.1",
     "express-session": "1.15.3",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
@@ -87,6 +88,7 @@
     "lib/"
   ],
   "scripts": {
+    "lint": "eslint .",
     "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
     "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
diff --git a/test/acceptance/error-pages.js b/test/acceptance/error-pages.js
index 886cedcabe3..9af950178da 100644
--- a/test/acceptance/error-pages.js
+++ b/test/acceptance/error-pages.js
@@ -99,4 +99,4 @@ describe('error-pages', function(){
       })
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/acceptance/error.js b/test/acceptance/error.js
index 6010f2e2ae4..6bdf099feed 100644
--- a/test/acceptance/error.js
+++ b/test/acceptance/error.js
@@ -26,4 +26,4 @@ describe('error', function(){
         .expect(404,done)
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/acceptance/route-map.js b/test/acceptance/route-map.js
index ae3eeea6507..0bd2a6d32e1 100644
--- a/test/acceptance/route-map.js
+++ b/test/acceptance/route-map.js
@@ -42,4 +42,4 @@ describe('route-map', function(){
       .expect('delete 12\'s pet 2', done);
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/app.engine.js b/test/app.engine.js
index 6d1ee1cacbf..b198292fa03 100644
--- a/test/app.engine.js
+++ b/test/app.engine.js
@@ -47,7 +47,7 @@ describe('app', function(){
         done();
       })
     })
-    
+
     it('should work "view engine" setting', function(done){
       var app = express();
 
@@ -62,7 +62,7 @@ describe('app', function(){
         done();
       })
     })
-    
+
     it('should work "view engine" with leading "."', function(done){
       var app = express();
 
diff --git a/test/config.js b/test/config.js
index e298e76a5c5..17a02b7ebab 100644
--- a/test/config.js
+++ b/test/config.js
@@ -49,7 +49,7 @@ describe('config', function () {
       var app = express();
       assert.strictEqual(app.get('foo'), undefined);
     })
-    
+
     it('should otherwise return the value', function(){
       var app = express();
       app.set('foo', 'bar');
@@ -125,7 +125,7 @@ describe('config', function () {
       assert.strictEqual(app.get('tobi'), true);
     })
   })
-  
+
   describe('.disable()', function(){
     it('should set the value to false', function(){
       var app = express();
@@ -133,26 +133,26 @@ describe('config', function () {
       assert.strictEqual(app.get('tobi'), false);
     })
   })
-  
+
   describe('.enabled()', function(){
     it('should default to false', function(){
       var app = express();
       assert.strictEqual(app.enabled('foo'), false);
     })
-    
+
     it('should return true when set', function(){
       var app = express();
       app.set('foo', 'bar');
       assert.strictEqual(app.enabled('foo'), true);
     })
   })
-  
+
   describe('.disabled()', function(){
     it('should default to true', function(){
       var app = express();
       assert.strictEqual(app.disabled('foo'), true);
     })
-    
+
     it('should return false when set', function(){
       var app = express();
       app.set('foo', 'bar');

From 1dbaae51ddb64c7397d19546bacb0792dbb7d59b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 5 Aug 2017 23:54:31 -0400
Subject: [PATCH 021/479] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 9f38f52bc1a..ab6db290342 100644
--- a/package.json
+++ b/package.json
@@ -60,9 +60,10 @@
     "after": "0.8.2",
     "body-parser": "1.17.2",
     "cookie-parser": "~1.4.3",
+    "cookie-session": "1.3.0",
     "ejs": "2.5.7",
     "eslint": "2.13.1",
-    "express-session": "1.15.3",
+    "express-session": "1.15.5",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
@@ -74,7 +75,6 @@
     "should": "11.2.1",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
-    "cookie-session": "~1.2.0",
     "vhost": "~3.0.2"
   },
   "engines": {

From 44881fabe3680722368df75c66125fbd5f8ed569 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 00:18:57 -0400
Subject: [PATCH 022/479] docs: update collaborator guide for lint script

---
 Collaborator-Guide.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Collaborator-Guide.md b/Collaborator-Guide.md
index 7c0d265dd0a..75d4e7c8f28 100644
--- a/Collaborator-Guide.md
+++ b/Collaborator-Guide.md
@@ -6,7 +6,7 @@ Open issues for the expressjs.com website in https://github.com/expressjs/expres
 ## PRs and Code contributions
 
 * Tests must pass.
-* Follow the [JavaScript Standard Style](http://standardjs.com/).
+* Follow the [JavaScript Standard Style](http://standardjs.com/) and `npm run lint`.
 * If you fix a bug, add a test.
 
 ## Branches
@@ -27,7 +27,9 @@ a future release of Express.
    each new issue you work on, although not compulsory.
 4. To run the test suite, first install the dependencies by running `npm install`,
    then run `npm test`.
-5. If the tests pass, you can commit your changes to your fork and then create
+5. Ensure your code is linted by running `npm run lint` -- fix any issue you
+   see listed.
+6. If the tests pass, you can commit your changes to your fork and then create
    a pull request from there. Make sure to reference your issue from the pull
    request comments by including the issue number e.g. `#123`.
 

From e0066227f787931bb0db09e76e007450d0f365b7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 00:19:32 -0400
Subject: [PATCH 023/479] lint: remove all unused varaibles

---
 .eslintrc                          | 3 ++-
 benchmarks/middleware.js           | 1 -
 examples/view-constructor/index.js | 1 -
 lib/utils.js                       | 1 -
 lib/view.js                        | 1 -
 test/Route.js                      | 1 -
 test/app.listen.js                 | 1 -
 test/app.locals.js                 | 1 -
 test/app.router.js                 | 1 -
 test/req.host.js                   | 1 -
 test/req.hostname.js               | 1 -
 test/req.range.js                  | 1 -
 test/res.download.js               | 1 -
 test/res.format.js                 | 1 -
 test/res.send.js                   | 1 -
 test/res.sendFile.js               | 4 ----
 test/res.sendStatus.js             | 1 -
 test/res.vary.js                   | 1 -
 18 files changed, 2 insertions(+), 21 deletions(-)

diff --git a/.eslintrc b/.eslintrc
index 8f51db362e8..ad9c0ce9eb7 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -2,6 +2,7 @@
   "rules": {
     "eol-last": "error",
     "indent": ["error", 2, { "SwitchCase": 1 }],
-    "no-trailing-spaces": "error"
+    "no-trailing-spaces": "error",
+    "no-unused-vars": ["error", { "vars": "all", "args": "none", "ignoreRestSiblings": true }]
   }
 }
diff --git a/benchmarks/middleware.js b/benchmarks/middleware.js
index 3aa7a8b4ac7..efbac12983a 100644
--- a/benchmarks/middleware.js
+++ b/benchmarks/middleware.js
@@ -1,5 +1,4 @@
 
-var http = require('http');
 var express = require('..');
 var app = express();
 
diff --git a/examples/view-constructor/index.js b/examples/view-constructor/index.js
index 195d32db0eb..175a254e4ee 100644
--- a/examples/view-constructor/index.js
+++ b/examples/view-constructor/index.js
@@ -3,7 +3,6 @@
  */
 
 var express = require('../../');
-var http = require('http');
 var GithubView = require('./github-view');
 var md = require('marked').parse;
 
diff --git a/lib/utils.js b/lib/utils.js
index f418c5807c7..ae2a7f862d2 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -17,7 +17,6 @@ var contentType = require('content-type');
 var deprecate = require('depd')('express');
 var flatten = require('array-flatten');
 var mime = require('send').mime;
-var basename = require('path').basename;
 var etag = require('etag');
 var proxyaddr = require('proxy-addr');
 var qs = require('qs');
diff --git a/lib/view.js b/lib/view.js
index 1728725d291..99d5aed7a07 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -16,7 +16,6 @@
 var debug = require('debug')('express:view');
 var path = require('path');
 var fs = require('fs');
-var utils = require('./utils');
 
 /**
  * Module variables.
diff --git a/test/Route.js b/test/Route.js
index d7a80bdbc01..8f90152d8c8 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -4,7 +4,6 @@ var should = require('should');
 var express = require('../')
   , Route = express.Route
   , methods = require('methods')
-  , assert = require('assert');
 
 describe('Route', function(){
   it('should work without handlers', function(done) {
diff --git a/test/app.listen.js b/test/app.listen.js
index b6f68578934..a78d16e4e1a 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -1,6 +1,5 @@
 
 var express = require('../')
-  , request = require('supertest');
 
 describe('app.listen()', function(){
   it('should wrap with an HTTP server', function(done){
diff --git a/test/app.locals.js b/test/app.locals.js
index a8b022957a2..d8bfb5a9874 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -1,6 +1,5 @@
 
 var express = require('../')
-  , request = require('supertest');
 
 describe('app', function(){
   describe('.locals(obj)', function(){
diff --git a/test/app.router.js b/test/app.router.js
index 95680f9139c..28561c2fbcd 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -39,7 +39,6 @@ describe('app.router', function(){
 
       it('should include ' + method.toUpperCase(), function(done){
         var app = express();
-        var calls = [];
 
         app[method]('/foo', function(req, res){
           if ('head' == method) {
diff --git a/test/req.host.js b/test/req.host.js
index 8fa3409054f..7bb0b27acf8 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , assert = require('assert');
 
 describe('req', function(){
   describe('.host', function(){
diff --git a/test/req.hostname.js b/test/req.hostname.js
index 65c2be81a1f..816cd597990 100644
--- a/test/req.hostname.js
+++ b/test/req.hostname.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , assert = require('assert');
 
 describe('req', function(){
   describe('.hostname', function(){
diff --git a/test/req.range.js b/test/req.range.js
index 09459d1e127..5443c0658d2 100644
--- a/test/req.range.js
+++ b/test/req.range.js
@@ -1,5 +1,4 @@
 
-var assert = require('assert');
 var express = require('..');
 var request = require('supertest')
 
diff --git a/test/res.download.js b/test/res.download.js
index 0671d8318c4..fad56ee256a 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -89,7 +89,6 @@ describe('res', function(){
 
     it('should remove Content-Disposition', function(done){
       var app = express()
-        , calls = 0;
 
       app.use(function (req, res, next) {
         res.download('test/fixtures/foobar.html', function(err){
diff --git a/test/res.format.js b/test/res.format.js
index 2b0dfd517e7..3c1d095b426 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , utils = require('../lib/utils')
   , assert = require('assert');
 
 var app1 = express();
diff --git a/test/res.send.js b/test/res.send.js
index f2e7d759c15..88d231eab55 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,5 +1,4 @@
 
-var assert = require('assert');
 var express = require('..');
 var methods = require('methods');
 var request = require('supertest');
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index a3576d02196..ff4b1cb2dd1 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -446,12 +446,10 @@ describe('res', function(){
 
     it('should invoke the callback on 403', function(done){
       var app = express()
-        , calls = 0;
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/foo/../user.html', function(err){
           assert(!res.headersSent);
-          ++calls;
           res.send(err.message);
         });
       });
@@ -464,7 +462,6 @@ describe('res', function(){
 
     it('should invoke the callback on socket error', function(done){
       var app = express()
-        , calls = 0;
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/user.html', function(err){
@@ -715,7 +712,6 @@ describe('res', function(){
       describe('with non-GET', function(){
         it('should still serve', function(done){
           var app = express()
-            , calls = 0;
 
           app.use(function(req, res){
             res.sendfile(path.join(__dirname, '/fixtures/name.txt'))
diff --git a/test/res.sendStatus.js b/test/res.sendStatus.js
index a97e1bf8d81..c355bc408f3 100644
--- a/test/res.sendStatus.js
+++ b/test/res.sendStatus.js
@@ -1,5 +1,4 @@
 
-var assert = require('assert')
 var express = require('..')
 var request = require('supertest')
 
diff --git a/test/res.vary.js b/test/res.vary.js
index 9a2edd24c09..9d39a341c0b 100644
--- a/test/res.vary.js
+++ b/test/res.vary.js
@@ -1,5 +1,4 @@
 
-var assert = require('assert');
 var express = require('..');
 var request = require('supertest');
 var utils = require('./support/utils');

From e2d725e01620fc3c8b3720e5521a124836e32cb2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 02:37:10 -0400
Subject: [PATCH 024/479] deps: send@0.15.4

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c67fd941745..422d52dede3 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,10 @@ unreleased
     - Fix array argument being altered
     - deps: ipaddr.js@1.4.0
   * deps: qs@6.5.0
+  * deps: send@0.15.4
+    - deps: debug@2.6.8
+    - deps: depd@~1.1.1
+    - deps: http-errors@~1.6.2
 
 4.15.3 / 2017-05-16
 ===================
diff --git a/package.json b/package.json
index ab6db290342..5c9e94f4898 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.5",
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
-    "send": "0.15.3",
+    "send": "0.15.4",
     "serve-static": "1.12.3",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From a50f1098d014e2393e2d5f4beae37a85830c203d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 02:38:02 -0400
Subject: [PATCH 025/479] deps: serve-static@1.12.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 422d52dede3..91707e6c03d 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,8 @@ unreleased
     - deps: debug@2.6.8
     - deps: depd@~1.1.1
     - deps: http-errors@~1.6.2
+  * deps: serve-static@1.12.4
+    - deps: send@0.15.4
 
 4.15.3 / 2017-05-16
 ===================
diff --git a/package.json b/package.json
index 5c9e94f4898..d5b9ae405df 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.4",
-    "serve-static": "1.12.3",
+    "serve-static": "1.12.4",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From a4bd4373b2c3b2521ee4c499cb8e90e98f78bfa5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 22:03:53 -0400
Subject: [PATCH 026/479] 4.15.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 91707e6c03d..f297e3b075c 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.15.4 / 2017-08-06
+===================
 
   * deps: debug@2.6.8
   * deps: depd@~1.1.1
diff --git a/package.json b/package.json
index d5b9ae405df..d8ec444d539 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.3",
+  "version": "4.15.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 48817a798f3820bbe252d30d33bd701779511dc5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 17 Aug 2017 22:03:40 -0400
Subject: [PATCH 027/479] build: remove minor pin for nightly

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5926ca5650a..3dbeb41fcda 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
 matrix:
   include:
-    - node_js: "8.0"
+    - node_js: "8"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail

From 78e55108e40ce8ce751baa10324f48a6bb21b47e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 13 Sep 2017 20:03:42 -0400
Subject: [PATCH 028/479] build: mocha@3.5.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d8ec444d539..2eec2887a7b 100644
--- a/package.json
+++ b/package.json
@@ -68,7 +68,7 @@
     "istanbul": "0.4.5",
     "marked": "0.3.6",
     "method-override": "2.3.9",
-    "mocha": "3.5.0",
+    "mocha": "3.5.3",
     "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",

From b208b24f8323930419d9b5bbe0f442b36852dc36 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 13 Sep 2017 20:09:33 -0400
Subject: [PATCH 029/479] build: should@13.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2eec2887a7b..5068a5d6144 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "11.2.1",
+    "should": "13.0.1",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From de5fb62b1ac8d02efcb7931ef12936cb0a954307 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 Sep 2017 20:13:05 -0400
Subject: [PATCH 030/479] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 5068a5d6144..a02a6943d37 100644
--- a/package.json
+++ b/package.json
@@ -58,9 +58,9 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.17.2",
+    "body-parser": "1.18.1",
     "cookie-parser": "~1.4.3",
-    "cookie-session": "1.3.0",
+    "cookie-session": "1.3.1",
     "ejs": "2.5.7",
     "eslint": "2.13.1",
     "express-session": "1.15.5",

From 9e067ad2cb96f23f7997758a7f5a3c69ada03c12 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Sep 2017 20:45:32 -0400
Subject: [PATCH 031/479] deps: fresh@0.5.2

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f297e3b075c..e7e37e92e24 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+unreleased
+==========
+
+  * deps: fresh@0.5.2
+    - Fix handling of modified headers with invalid dates
+    - perf: improve ETag match loop
+    - perf: improve `If-None-Match` token parsing
+
 4.15.4 / 2017-08-06
 ===================
 
diff --git a/package.json b/package.json
index a02a6943d37..87e4ee8eae4 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
     "finalhandler": "~1.0.4",
-    "fresh": "0.5.0",
+    "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",

From 9e0fa7f1ca2efe768e91ee84534f837d2cff243a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Sep 2017 20:46:42 -0400
Subject: [PATCH 032/479] deps: send@0.15.5

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e7e37e92e24..83cd43185e5 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,10 @@ unreleased
     - Fix handling of modified headers with invalid dates
     - perf: improve ETag match loop
     - perf: improve `If-None-Match` token parsing
+  * deps: send@0.15.5
+    - Fix handling of modified headers with invalid dates
+    - deps: etag@~1.8.1
+    - deps: fresh@0.5.2
 
 4.15.4 / 2017-08-06
 ===================
diff --git a/package.json b/package.json
index 87e4ee8eae4..2ad3c5e2a99 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.5",
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
-    "send": "0.15.4",
+    "send": "0.15.5",
     "serve-static": "1.12.4",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From 961dbff904d3e6b1b10cfe6741506ae851d272ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Sep 2017 20:48:23 -0400
Subject: [PATCH 033/479] deps: serve-static@1.12.5

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 83cd43185e5..95fad3d3d97 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,9 @@ unreleased
     - Fix handling of modified headers with invalid dates
     - deps: etag@~1.8.1
     - deps: fresh@0.5.2
+  * deps: serve-static@1.12.5
+    - deps: parseurl@~1.3.2
+    - deps: send@0.15.5
 
 4.15.4 / 2017-08-06
 ===================
diff --git a/package.json b/package.json
index 2ad3c5e2a99..4bb68915b8e 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.5",
-    "serve-static": "1.12.4",
+    "serve-static": "1.12.5",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From d7da22550da484ddcdf77623272b64c36030b216 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Sep 2017 20:49:14 -0400
Subject: [PATCH 034/479] build: should@13.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4bb68915b8e..97f94459b83 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "13.0.1",
+    "should": "13.1.0",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From 19a2eeb47697feecae5960a726fb5b7ae2c7644b Mon Sep 17 00:00:00 2001
From: Kunal Pathak <Kunal.Pathak@microsoft.com>
Date: Tue, 21 Mar 2017 14:53:42 -0700
Subject: [PATCH 035/479] tests: check render error without engine-specific
 message

closes #3251
---
 test/app.render.js   | 10 ++++------
 test/res.render.js   | 10 ++++++----
 test/support/tmpl.js |  1 +
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/test/app.render.js b/test/app.render.js
index 1485098f582..54f6c2ca82d 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -97,12 +97,10 @@ describe('app', function(){
 
         app.set('views', path.join(__dirname, 'fixtures'))
 
-        app.render('user.tmpl', function (err, str) {
-          // nextTick to prevent cyclic
-          process.nextTick(function(){
-            err.message.should.match(/Cannot read property '[^']+' of undefined/);
-            done();
-          });
+        app.render('user.tmpl', function (err) {
+          assert.ok(err)
+          assert.equal(err.name, 'RenderError')
+          done()
         })
       })
     })
diff --git a/test/res.render.js b/test/res.render.js
index 2e3a16f1370..e19e8cc542b 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -105,12 +105,12 @@ describe('res', function(){
         });
 
         app.use(function(err, req, res, next){
-          res.end(err.message);
+          res.status(500).send('got error: ' + err.name)
         });
 
         request(app)
         .get('/')
-        .expect(/Cannot read property '[^']+' of undefined/, done);
+        .expect(500, 'got error: RenderError', done)
       })
     })
 
@@ -329,13 +329,15 @@ describe('res', function(){
 
         app.use(function(req, res){
           res.render('user.tmpl', function (err) {
-            res.end(err.message);
+            if (err) {
+              res.status(500).send('got error: ' + err.name)
+            }
           });
         });
 
         request(app)
         .get('/')
-        .expect(/Cannot read property '[^']+' of undefined/, done);
+        .expect(500, 'got error: RenderError', done)
       })
     })
   })
diff --git a/test/support/tmpl.js b/test/support/tmpl.js
index 2e8bec86388..bab65669d33 100644
--- a/test/support/tmpl.js
+++ b/test/support/tmpl.js
@@ -13,6 +13,7 @@ module.exports = function renderFile(fileName, options, callback) {
       str = str.replace(variableRegExp, generateVariableLookup(options));
     } catch (e) {
       err = e;
+      err.name = 'RenderError'
     }
 
     callback(err, str);

From 9395db4c22567d09f19ac7cd629e23908784ec6d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 22 Sep 2017 20:25:18 -0400
Subject: [PATCH 036/479] deps: debug@2.6.9

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 95fad3d3d97..5bf412451be 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: debug@2.6.9
   * deps: fresh@0.5.2
     - Fix handling of modified headers with invalid dates
     - perf: improve ETag match loop
diff --git a/package.json b/package.json
index 97f94459b83..7f465d0e642 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "content-type": "~1.0.2",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "debug": "2.6.8",
+    "debug": "2.6.9",
     "depd": "~1.1.1",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",

From bd1672f0a45e2722126a05723aca68cbd65e3f74 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 22 Sep 2017 20:26:30 -0400
Subject: [PATCH 037/479] deps: finalhandler@~1.0.6

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5bf412451be..e4770be6885 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * deps: debug@2.6.9
+  * deps: finalhandler@~1.0.6
+    - deps: debug@2.6.9
+    - deps: parseurl@~1.3.2
   * deps: fresh@0.5.2
     - Fix handling of modified headers with invalid dates
     - perf: improve ETag match loop
diff --git a/package.json b/package.json
index 7f465d0e642..3afcec06718 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
-    "finalhandler": "~1.0.4",
+    "finalhandler": "~1.0.6",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 7137bf567db674fa5a93b71fffda09e7ac4ec73c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 22 Sep 2017 20:27:37 -0400
Subject: [PATCH 038/479] deps: send@0.15.6

---
 History.md   | 4 +++-
 package.json | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index e4770be6885..3d2bb66505c 100644
--- a/History.md
+++ b/History.md
@@ -9,10 +9,12 @@ unreleased
     - Fix handling of modified headers with invalid dates
     - perf: improve ETag match loop
     - perf: improve `If-None-Match` token parsing
-  * deps: send@0.15.5
+  * deps: send@0.15.6
     - Fix handling of modified headers with invalid dates
+    - deps: debug@2.6.9
     - deps: etag@~1.8.1
     - deps: fresh@0.5.2
+    - perf: improve `If-Match` token parsing
   * deps: serve-static@1.12.5
     - deps: parseurl@~1.3.2
     - deps: send@0.15.5
diff --git a/package.json b/package.json
index 3afcec06718..16b11d6fdb1 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.5",
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
-    "send": "0.15.5",
+    "send": "0.15.6",
     "serve-static": "1.12.5",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From 40435ec99779b08202f9f139c9a0a7d64e941b40 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 22 Sep 2017 20:28:52 -0400
Subject: [PATCH 039/479] deps: serve-static@1.12.6

---
 History.md   | 5 +++--
 package.json | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3d2bb66505c..fa520920d7c 100644
--- a/History.md
+++ b/History.md
@@ -15,9 +15,10 @@ unreleased
     - deps: etag@~1.8.1
     - deps: fresh@0.5.2
     - perf: improve `If-Match` token parsing
-  * deps: serve-static@1.12.5
+  * deps: serve-static@1.12.6
     - deps: parseurl@~1.3.2
-    - deps: send@0.15.5
+    - deps: send@0.15.6
+    - perf: improve slash collapsing
 
 4.15.4 / 2017-08-06
 ===================
diff --git a/package.json b/package.json
index 16b11d6fdb1..bf48b83c7cc 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.6",
-    "serve-static": "1.12.5",
+    "serve-static": "1.12.6",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From ea3d60565242c47be97088ead2708d7b88390858 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 01:04:38 -0400
Subject: [PATCH 040/479] 4.15.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index fa520920d7c..707677eb17a 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.15.5 / 2017-09-24
+===================
 
   * deps: debug@2.6.9
   * deps: finalhandler@~1.0.6
diff --git a/package.json b/package.json
index bf48b83c7cc..954c20b3c30 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.4",
+  "version": "4.15.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 94fdb674b1df2e36d389fce51f5e07071f807adb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 20:57:54 -0400
Subject: [PATCH 041/479] build: support Node.js 8.x

---
 .gitignore   | 1 +
 .travis.yml  | 4 ++++
 appveyor.yml | 2 ++
 3 files changed, 7 insertions(+)

diff --git a/.gitignore b/.gitignore
index 9723e60591d..5fee6a2dc97 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,7 @@ Desktop.ini
 
 # npm
 node_modules
+package-lock.json
 *.log
 *.gz
 
diff --git a/.travis.yml b/.travis.yml
index 3dbeb41fcda..3e487a6f186 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,6 +9,7 @@ node_js:
   - "5.12"
   - "6.11"
   - "7.10"
+  - "8.4"
 matrix:
   include:
     - node_js: "8"
@@ -21,6 +22,9 @@ cache:
   directories:
     - node_modules
 before_install:
+  # Skip updating shrinkwrap / lock
+  - "npm config set shrinkwrap false"
+
   # Remove all non-test dependencies
   - "npm rm --save-dev connect-redis"
 
diff --git a/appveyor.yml b/appveyor.yml
index 9863c08e272..193660af715 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,10 +9,12 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.11"
     - nodejs_version: "7.10"
+    - nodejs_version: "8.4"
 cache:
   - node_modules
 install:
   - ps: Install-Product node $env:nodejs_version
+  - npm config set shrinkwrap false
   - npm rm --save-dev connect-redis
   - if exist node_modules npm prune
   - if exist node_modules npm rebuild

From c3fb7e5adc1fd40e301ed1e25f0d5b5a393d0295 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 21:06:00 -0400
Subject: [PATCH 042/479] build: test against Node.js 9.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 3e487a6f186..855168ff540 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,6 +14,8 @@ matrix:
   include:
     - node_js: "8"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "9"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From 80f1ea9bec3c5aedb08a6917ecc24fb8d22b707d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 21:11:33 -0400
Subject: [PATCH 043/479] Improve error message when autoloading invalid view
 engine

fixes #3403
---
 History.md                |  5 +++++
 lib/view.js               | 10 +++++++++-
 test/fixtures/broken.send |  0
 test/res.render.js        | 14 ++++++++++++++
 4 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 test/fixtures/broken.send

diff --git a/History.md b/History.md
index 707677eb17a..765f050318a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Improve error message when autoloading invalid view engine
+
 4.15.5 / 2017-09-24
 ===================
 
diff --git a/lib/view.js b/lib/view.js
index 99d5aed7a07..cf101caeab9 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -76,7 +76,15 @@ function View(name, options) {
     // load engine
     var mod = this.ext.substr(1)
     debug('require "%s"', mod)
-    opts.engines[this.ext] = require(mod).__express
+
+    // default engine export
+    var fn = require(mod).__express
+
+    if (typeof fn !== 'function') {
+      throw new Error('Module "' + mod + '" does not provide a view engine.')
+    }
+
+    opts.engines[this.ext] = fn
   }
 
   // store loaded engine
diff --git a/test/fixtures/broken.send b/test/fixtures/broken.send
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/test/res.render.js b/test/res.render.js
index e19e8cc542b..643a57002a0 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -35,6 +35,20 @@ describe('res', function(){
       .expect('<p>tobi</p>', done);
     })
 
+    it('should error without "view engine" set and file extension to a non-engine module', function (done) {
+      var app = createApp()
+
+      app.locals.user = { name: 'tobi' }
+
+      app.use(function (req, res) {
+        res.render(path.join(__dirname, 'fixtures', 'broken.send'))
+      })
+
+      request(app)
+      .get('/')
+      .expect(500, /does not provide a view engine/, done)
+    })
+
     it('should error without "view engine" set and no file extension', function (done) {
       var app = createApp();
 

From 48940e61202be07677659b3b9d87c967fc4e8bdc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 21:12:47 -0400
Subject: [PATCH 044/479] Skip Buffer encoding when not generating ETag for
 small response

---
 History.md      |  1 +
 lib/response.js | 23 ++++++++++++++++-------
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/History.md b/History.md
index 765f050318a..83ba2cc5d76 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Improve error message when autoloading invalid view engine
+  * Skip `Buffer` encoding when not generating ETag for small response
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/lib/response.js b/lib/response.js
index b852a60e2f5..e34af49d693 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -106,7 +106,6 @@ res.links = function(links){
 res.send = function send(body) {
   var chunk = body;
   var encoding;
-  var len;
   var req = this.req;
   var type;
 
@@ -171,23 +170,33 @@ res.send = function send(body) {
     }
   }
 
+  // determine if ETag should be generated
+  var etagFn = app.get('etag fn')
+  var generateETag = !this.get('ETag') && typeof etagFn === 'function'
+
   // populate Content-Length
+  var len
   if (chunk !== undefined) {
-    if (!Buffer.isBuffer(chunk)) {
-      // convert chunk to Buffer; saves later double conversions
+    if (!generateETag && chunk.length < 1000) {
+      // just calculate length when no ETag + small chunk
+      len = Buffer.byteLength(chunk, encoding)
+    } else if (!Buffer.isBuffer(chunk)) {
+      // convert chunk to Buffer and calculate
       chunk = new Buffer(chunk, encoding);
       encoding = undefined;
+      len = chunk.length
+    } else {
+      // get length of Buffer
+      len = chunk.length
     }
 
-    len = chunk.length;
     this.set('Content-Length', len);
   }
 
   // populate ETag
   var etag;
-  var generateETag = len !== undefined && app.get('etag fn');
-  if (typeof generateETag === 'function' && !this.get('ETag')) {
-    if ((etag = generateETag(chunk, encoding))) {
+  if (generateETag && len !== undefined) {
+    if ((etag = etagFn(chunk, encoding))) {
       this.set('ETag', etag);
     }
   }

From 550043c21727674a9d00c30504beb95cfbd7bbba Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 21:14:00 -0400
Subject: [PATCH 045/479] deps: setprototypeof@1.1.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 83ba2cc5d76..e8fcafa4149 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Improve error message when autoloading invalid view engine
   * Skip `Buffer` encoding when not generating ETag for small response
+  * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/package.json b/package.json
index 954c20b3c30..cd94d1cf94a 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "range-parser": "~1.2.0",
     "send": "0.15.6",
     "serve-static": "1.12.6",
-    "setprototypeof": "1.0.3",
+    "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",
     "utils-merge": "1.0.0",

From 9a99c152703048591c031bd10d2a2e3ca55ebcac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Sep 2017 21:28:25 -0400
Subject: [PATCH 046/479] deps: accepts@~1.3.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e8fcafa4149..0c206496496 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * Improve error message when autoloading invalid view engine
   * Skip `Buffer` encoding when not generating ETag for small response
+  * deps: accepts@~1.3.4
+    - deps: mime-types@~2.1.16
   * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index cd94d1cf94a..9351cf2e05b 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.3.3",
+    "accepts": "~1.3.4",
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.2",
     "content-type": "~1.0.2",

From 70589c3aef6fb64ce396848e78ca7ea0768d2d5d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Sep 2017 21:30:08 -0400
Subject: [PATCH 047/479] deps: content-type@~1.0.4

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0c206496496..0f6f82bffef 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,9 @@ unreleased
   * Skip `Buffer` encoding when not generating ETag for small response
   * deps: accepts@~1.3.4
     - deps: mime-types@~2.1.16
+  * deps: content-type@~1.0.4
+    - perf: remove argument reassignment
+    - perf: skip parameter parsing when no parameters
   * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index 9351cf2e05b..5febf1048e5 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "accepts": "~1.3.4",
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.2",
-    "content-type": "~1.0.2",
+    "content-type": "~1.0.4",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",

From e62bb8bf9f68382414cdd7997fe661de4647c987 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Sep 2017 21:30:43 -0400
Subject: [PATCH 048/479] deps: etag@~1.8.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0f6f82bffef..077eec931b5 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@ unreleased
   * deps: content-type@~1.0.4
     - perf: remove argument reassignment
     - perf: skip parameter parsing when no parameters
+  * deps: etag@~1.8.1
+    - perf: replace regular expression with substring
   * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index 5febf1048e5..78834c50721 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "depd": "~1.1.1",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
-    "etag": "~1.8.0",
+    "etag": "~1.8.1",
     "finalhandler": "~1.0.6",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",

From ad7d96db479e6e9d93ab4848d5fe163905e123ed Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Sep 2017 21:31:39 -0400
Subject: [PATCH 049/479] deps: qs@6.5.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 077eec931b5..012d8a2ffed 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,8 @@ unreleased
     - perf: skip parameter parsing when no parameters
   * deps: etag@~1.8.1
     - perf: replace regular expression with substring
+  * deps: qs@6.5.1
+    - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index 78834c50721..0bbfeb8e6ea 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.5",
-    "qs": "6.5.0",
+    "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "send": "0.15.6",
     "serve-static": "1.12.6",

From 5cc761c86593f2e87c7a9dac02135548096bb952 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 00:04:47 -0400
Subject: [PATCH 050/479] deps: parseurl@~1.3.2

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 012d8a2ffed..2c9866dbb5d 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,9 @@ unreleased
     - perf: skip parameter parsing when no parameters
   * deps: etag@~1.8.1
     - perf: replace regular expression with substring
+  * deps: parseurl@~1.3.2
+    - perf: reduce overhead for full URLs
+    - perf: unroll the "fast-path" `RegExp`
   * deps: qs@6.5.1
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
diff --git a/package.json b/package.json
index 0bbfeb8e6ea..4330b141f08 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",
-    "parseurl": "~1.3.1",
+    "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.5",
     "qs": "6.5.1",

From 673d51f4f0fa83f6b663ed6f9f0426940d07664b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 00:19:30 -0400
Subject: [PATCH 051/479] deps: utils-merge@1.0.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2c9866dbb5d..eb01929864f 100644
--- a/History.md
+++ b/History.md
@@ -16,6 +16,7 @@ unreleased
   * deps: qs@6.5.1
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
+  * deps: utils-merge@1.0.1
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/package.json b/package.json
index 4330b141f08..1298b943275 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",
-    "utils-merge": "1.0.0",
+    "utils-merge": "1.0.1",
     "vary": "~1.1.1"
   },
   "devDependencies": {

From c2f4fb535688eaec14c713190a4ab881e195a41a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 00:42:05 -0400
Subject: [PATCH 052/479] deps: finalhandler@1.1.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index eb01929864f..c4b34a76439 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,8 @@ unreleased
     - perf: skip parameter parsing when no parameters
   * deps: etag@~1.8.1
     - perf: replace regular expression with substring
+  * deps: finalhandler@1.1.0
+    - Use `res.headersSent` when available
   * deps: parseurl@~1.3.2
     - perf: reduce overhead for full URLs
     - perf: unroll the "fast-path" `RegExp`
diff --git a/package.json b/package.json
index 1298b943275..ea49823cbbf 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "~1.0.6",
+    "finalhandler": "1.1.0",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 02a9d5fb28e313fd94ee5ec24fe5da02fbc0d6eb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 01:18:04 -0400
Subject: [PATCH 053/479] deps: proxy-addr@~2.0.2

closes #3432
---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c4b34a76439..4352f26acdf 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,11 @@ unreleased
   * deps: parseurl@~1.3.2
     - perf: reduce overhead for full URLs
     - perf: unroll the "fast-path" `RegExp`
+  * deps: proxy-addr@~2.0.2
+    - Fix trimming leading / trailing OWS in `X-Forwarded-For`
+    - deps: forwarded@~0.1.2
+    - deps: ipaddr.js@1.5.2
+    - perf: reduce overhead when no `X-Forwarded-For` header
   * deps: qs@6.5.1
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
diff --git a/package.json b/package.json
index ea49823cbbf..219e21fe23b 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~1.1.5",
+    "proxy-addr": "~2.0.2",
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "send": "0.15.6",

From d9d09b8b9041504b645f3173ca70ef173c7e1563 Mon Sep 17 00:00:00 2001
From: Lawrence Page <lpage2008@gmail.com>
Date: Thu, 18 May 2017 11:04:27 -0700
Subject: [PATCH 054/479] perf: re-use options object when generating ETags

closes #3313
closes #3314
---
 History.md   |  1 +
 lib/utils.js | 35 +++++++++++++++++++++--------------
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/History.md b/History.md
index 4352f26acdf..4b4f0dd5cbf 100644
--- a/History.md
+++ b/History.md
@@ -24,6 +24,7 @@ unreleased
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
   * deps: utils-merge@1.0.1
+  * perf: re-use options object when generating ETags
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/lib/utils.js b/lib/utils.js
index ae2a7f862d2..80f4edae3a3 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -31,13 +31,7 @@ var querystring = require('querystring');
  * @api private
  */
 
-exports.etag = function (body, encoding) {
-  var buf = !Buffer.isBuffer(body)
-    ? new Buffer(body, encoding)
-    : body;
-
-  return etag(buf, {weak: false});
-};
+exports.etag = createETagGenerator({ weak: false })
 
 /**
  * Return weak ETag for `body`.
@@ -48,13 +42,7 @@ exports.etag = function (body, encoding) {
  * @api private
  */
 
-exports.wetag = function wetag(body, encoding){
-  var buf = !Buffer.isBuffer(body)
-    ? new Buffer(body, encoding)
-    : body;
-
-  return etag(buf, {weak: true});
-};
+exports.wetag = createETagGenerator({ weak: true })
 
 /**
  * Check if `path` looks absolute.
@@ -273,6 +261,25 @@ exports.setCharset = function setCharset(type, charset) {
   return contentType.format(parsed);
 };
 
+/**
+ * Create an ETag generator function, generating ETags with
+ * the given options.
+ *
+ * @param {object} options
+ * @return {function}
+ * @private
+ */
+
+function createETagGenerator (options) {
+  return function generateETag (body, encoding) {
+    var buf = !Buffer.isBuffer(body)
+      ? new Buffer(body, encoding)
+      : body
+
+    return etag(buf, options)
+  }
+}
+
 /**
  * Parse an extended query string with qs.
  *

From fa272edf843a31aa242390d46935437451707d54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hrvoje=20=C5=A0imi=C4=87?= <shime@twobucks.co>
Date: Wed, 27 Sep 2017 15:17:03 +0200
Subject: [PATCH 055/479] docs: fix typo in jsdoc comment

closes #3430
---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index 1abe8d08f58..8097d81a3b9 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -338,7 +338,7 @@ app.param = function param(name, fn) {
  * Assign `setting` to `val`, or return `setting`'s value.
  *
  *    app.set('foo', 'bar');
- *    app.get('foo');
+ *    app.set('foo');
  *    // => "bar"
  *
  * Mounted servers inherit their parent server's settings.

From 12c37124689380837b24a7ed962432596237b440 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 08:26:39 -0400
Subject: [PATCH 056/479] Use safe-buffer for improved Buffer API

---
 History.md               |  1 +
 benchmarks/middleware.js |  4 +---
 lib/response.js          |  5 +++--
 lib/utils.js             |  3 ++-
 package.json             |  1 +
 test/res.attachment.js   |  3 ++-
 test/res.send.js         | 12 ++++++------
 test/utils.js            |  7 +++----
 8 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/History.md b/History.md
index 4b4f0dd5cbf..18f5e5da371 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Improve error message when autoloading invalid view engine
   * Skip `Buffer` encoding when not generating ETag for small response
+  * Use `safe-buffer` for improved Buffer API
   * deps: accepts@~1.3.4
     - deps: mime-types@~2.1.16
   * deps: content-type@~1.0.4
diff --git a/benchmarks/middleware.js b/benchmarks/middleware.js
index efbac12983a..df4df2c5ac5 100644
--- a/benchmarks/middleware.js
+++ b/benchmarks/middleware.js
@@ -13,10 +13,8 @@ while (n--) {
   });
 }
 
-var body = new Buffer('Hello World');
-
 app.use(function(req, res, next){
-  res.send(body);
+  res.send('Hello World')
 });
 
 app.listen(3333);
diff --git a/lib/response.js b/lib/response.js
index e34af49d693..285daf4fb4b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -12,6 +12,7 @@
  * @private
  */
 
+var Buffer = require('safe-buffer').Buffer
 var contentDisposition = require('content-disposition');
 var deprecate = require('depd')('express');
 var encodeUrl = require('encodeurl');
@@ -95,7 +96,7 @@ res.links = function(links){
  *
  * Examples:
  *
- *     res.send(new Buffer('wahoo'));
+ *     res.send(Buffer.from('wahoo'));
  *     res.send({ some: 'json' });
  *     res.send('<p>some html</p>');
  *
@@ -182,7 +183,7 @@ res.send = function send(body) {
       len = Buffer.byteLength(chunk, encoding)
     } else if (!Buffer.isBuffer(chunk)) {
       // convert chunk to Buffer and calculate
-      chunk = new Buffer(chunk, encoding);
+      chunk = Buffer.from(chunk, encoding)
       encoding = undefined;
       len = chunk.length
     } else {
diff --git a/lib/utils.js b/lib/utils.js
index 80f4edae3a3..bd81ac7f6d9 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -12,6 +12,7 @@
  * @api private
  */
 
+var Buffer = require('safe-buffer').Buffer
 var contentDisposition = require('content-disposition');
 var contentType = require('content-type');
 var deprecate = require('depd')('express');
@@ -273,7 +274,7 @@ exports.setCharset = function setCharset(type, charset) {
 function createETagGenerator (options) {
   return function generateETag (body, encoding) {
     var buf = !Buffer.isBuffer(body)
-      ? new Buffer(body, encoding)
+      ? Buffer.from(body, encoding)
       : body
 
     return etag(buf, options)
diff --git a/package.json b/package.json
index 219e21fe23b..dbbd7810042 100644
--- a/package.json
+++ b/package.json
@@ -48,6 +48,7 @@
     "proxy-addr": "~2.0.2",
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
+    "safe-buffer": "5.1.1",
     "send": "0.15.6",
     "serve-static": "1.12.6",
     "setprototypeof": "1.1.0",
diff --git a/test/res.attachment.js b/test/res.attachment.js
index 662b1dd4e01..4c3d4aa2f1b 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -1,4 +1,5 @@
 
+var Buffer = require('safe-buffer').Buffer
 var express = require('../')
   , request = require('supertest');
 
@@ -36,7 +37,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.attachment('/path/to/image.png');
-        res.send(new Buffer(4));
+        res.send(Buffer.alloc(4, '.'))
       });
 
       request(app)
diff --git a/test/res.send.js b/test/res.send.js
index 88d231eab55..7aa8d7d90e2 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,4 +1,5 @@
 
+var Buffer = require('safe-buffer').Buffer
 var express = require('..');
 var methods = require('methods');
 var request = require('supertest');
@@ -166,7 +167,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.set('Content-Type', 'text/plain; charset=iso-8859-1').send(new Buffer('hi'));
+        res.set('Content-Type', 'text/plain; charset=iso-8859-1').send(Buffer.from('hi'))
       });
 
       request(app)
@@ -181,7 +182,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.send(new Buffer('hello'));
+        res.send(Buffer.from('hello'))
       });
 
       request(app)
@@ -194,8 +195,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function (req, res) {
-        var str = Array(1000).join('-');
-        res.send(new Buffer(str));
+        res.send(Buffer.alloc(999, '-'))
       });
 
       request(app)
@@ -208,7 +208,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.set('Content-Type', 'text/plain').send(new Buffer('hey'));
+        res.set('Content-Type', 'text/plain').send(Buffer.from('hey'))
       });
 
       request(app)
@@ -512,7 +512,7 @@ describe('res', function(){
 
         app.set('etag', function (body, encoding) {
           var chunk = !Buffer.isBuffer(body)
-            ? new Buffer(body, encoding)
+            ? Buffer.from(body, encoding)
             : body;
           chunk.toString().should.equal('hello, world!');
           return '"custom"';
diff --git a/test/utils.js b/test/utils.js
index c49019fe126..b51d223af97 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -1,5 +1,6 @@
 
 var assert = require('assert');
+var Buffer = require('safe-buffer').Buffer
 var utils = require('../lib/utils');
 
 describe('utils.etag(body, encoding)', function(){
@@ -14,8 +15,7 @@ describe('utils.etag(body, encoding)', function(){
   })
 
   it('should support buffer', function(){
-    var buf = new Buffer('express!')
-    utils.etag(buf)
+    utils.etag(Buffer.from('express!'))
     .should.eql('"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
@@ -59,8 +59,7 @@ describe('utils.wetag(body, encoding)', function(){
   })
 
   it('should support buffer', function(){
-    var buf = new Buffer('express!')
-    utils.wetag(buf)
+    utils.wetag(Buffer.from('express!'))
     .should.eql('W/"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 

From 2df1ad26a58bf51228d7600df0d62ed17a90ff71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hrvoje=20=C5=A0imi=C4=87?= <shime@twobucks.co>
Date: Tue, 26 Sep 2017 16:00:53 +0200
Subject: [PATCH 057/479] Improve error messages when non-function provided as
 middleware

closes #3426
---
 History.md          |  1 +
 lib/application.js  |  2 +-
 lib/router/index.js |  4 ++--
 lib/router/route.js |  4 ++--
 test/Router.js      | 30 +++++++++++++++++++++---------
 test/app.use.js     | 31 ++++++++++++++++++++++---------
 6 files changed, 49 insertions(+), 23 deletions(-)

diff --git a/History.md b/History.md
index 18f5e5da371..63a1bdf60b7 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Improve error message when autoloading invalid view engine
+  * Improve error messages when non-function provided as middleware
   * Skip `Buffer` encoding when not generating ETag for small response
   * Use `safe-buffer` for improved Buffer API
   * deps: accepts@~1.3.4
diff --git a/lib/application.js b/lib/application.js
index 8097d81a3b9..91f77d241e4 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -207,7 +207,7 @@ app.use = function use(fn) {
   var fns = flatten(slice.call(arguments, offset));
 
   if (fns.length === 0) {
-    throw new TypeError('app.use() requires middleware functions');
+    throw new TypeError('app.use() requires a middleware function')
   }
 
   // setup router
diff --git a/lib/router/index.js b/lib/router/index.js
index 51db4c28ff9..60727ed6d64 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -448,14 +448,14 @@ proto.use = function use(fn) {
   var callbacks = flatten(slice.call(arguments, offset));
 
   if (callbacks.length === 0) {
-    throw new TypeError('Router.use() requires middleware functions');
+    throw new TypeError('Router.use() requires a middleware function')
   }
 
   for (var i = 0; i < callbacks.length; i++) {
     var fn = callbacks[i];
 
     if (typeof fn !== 'function') {
-      throw new TypeError('Router.use() requires middleware function but got a ' + gettype(fn));
+      throw new TypeError('Router.use() requires a middleware function but got a ' + gettype(fn))
     }
 
     // add the middleware
diff --git a/lib/router/route.js b/lib/router/route.js
index ea82ed29df5..178df0d5160 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -175,7 +175,7 @@ Route.prototype.all = function all() {
 
     if (typeof handle !== 'function') {
       var type = toString.call(handle);
-      var msg = 'Route.all() requires callback functions but got a ' + type;
+      var msg = 'Route.all() requires a callback function but got a ' + type
       throw new TypeError(msg);
     }
 
@@ -198,7 +198,7 @@ methods.forEach(function(method){
 
       if (typeof handle !== 'function') {
         var type = toString.call(handle);
-        var msg = 'Route.' + method + '() requires callback functions but got a ' + type;
+        var msg = 'Route.' + method + '() requires a callback function but got a ' + type
         throw new Error(msg);
       }
 
diff --git a/test/Router.js b/test/Router.js
index 18153d29267..057ce443df4 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -368,17 +368,29 @@ describe('Router', function(){
   })
 
   describe('.use', function() {
-    it('should require arguments', function(){
-      var router = new Router();
-      router.use.bind(router).should.throw(/requires middleware function/)
+    it('should require middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/') }, /requires a middleware function/)
     })
 
-    it('should not accept non-functions', function(){
-      var router = new Router();
-      router.use.bind(router, '/', 'hello').should.throw(/requires middleware function.*string/)
-      router.use.bind(router, '/', 5).should.throw(/requires middleware function.*number/)
-      router.use.bind(router, '/', null).should.throw(/requires middleware function.*Null/)
-      router.use.bind(router, '/', new Date()).should.throw(/requires middleware function.*Date/)
+    it('should reject string as middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/', 'foo') }, /requires a middleware function but got a string/)
+    })
+
+    it('should reject number as middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/', 42) }, /requires a middleware function but got a number/)
+    })
+
+    it('should reject null as middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/', null) }, /requires a middleware function but got a Null/)
+    })
+
+    it('should reject Date as middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/', new Date()) }, /requires a middleware function but got a Date/)
     })
 
     it('should be called for any URL', function (done) {
diff --git a/test/app.use.js b/test/app.use.js
index b2031e4c56c..347937fbb3b 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -1,5 +1,6 @@
 
 var after = require('after');
+var assert = require('assert')
 var express = require('..');
 var request = require('supertest');
 
@@ -253,17 +254,29 @@ describe('app', function(){
   })
 
   describe('.use(path, middleware)', function(){
-    it('should reject missing functions', function () {
-      var app = express();
-      app.use.bind(app, '/').should.throw(/requires middleware function/);
+    it('should require middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/') }, /requires a middleware function/)
     })
 
-    it('should reject non-functions as middleware', function () {
-      var app = express();
-      app.use.bind(app, '/', 'hi').should.throw(/requires middleware function.*string/);
-      app.use.bind(app, '/', 5).should.throw(/requires middleware function.*number/);
-      app.use.bind(app, '/', null).should.throw(/requires middleware function.*Null/);
-      app.use.bind(app, '/', new Date()).should.throw(/requires middleware function.*Date/);
+    it('should reject string as middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/', 'foo') }, /requires a middleware function but got a string/)
+    })
+
+    it('should reject number as middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/', 42) }, /requires a middleware function but got a number/)
+    })
+
+    it('should reject null as middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/', null) }, /requires a middleware function but got a Null/)
+    })
+
+    it('should reject Date as middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/', new Date()) }, /requires a middleware function but got a Date/)
     })
 
     it('should strip path from req.url', function (done) {

From 44591fee234dd83e05894c5b055703db1f68184c Mon Sep 17 00:00:00 2001
From: chainhelen <chainhelen@gmail.com>
Date: Thu, 28 Sep 2017 12:25:27 +0800
Subject: [PATCH 058/479] deps: vary@~1.1.2

closes #3434
---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 63a1bdf60b7..04b68978330 100644
--- a/History.md
+++ b/History.md
@@ -26,6 +26,8 @@ unreleased
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
   * deps: utils-merge@1.0.1
+  * deps: vary@~1.1.2
+    - perf: improve header token parsing speed
   * perf: re-use options object when generating ETags
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index dbbd7810042..0a476d67d90 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",
     "utils-merge": "1.0.1",
-    "vary": "~1.1.1"
+    "vary": "~1.1.2"
   },
   "devDependencies": {
     "after": "0.8.2",

From 95fb5cc26848d4c2c57b0a7a74f088538d47d312 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 10:30:10 -0400
Subject: [PATCH 059/479] perf: remove dead .charset set in res.jsonp

---
 History.md      | 1 +
 lib/response.js | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 04b68978330..c2d2595731a 100644
--- a/History.md
+++ b/History.md
@@ -29,6 +29,7 @@ unreleased
   * deps: vary@~1.1.2
     - perf: improve header token parsing speed
   * perf: re-use options object when generating ETags
+  * perf: remove dead `.charset` set in `res.jsonp`
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/lib/response.js b/lib/response.js
index 285daf4fb4b..9f61648c17b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -314,7 +314,6 @@ res.jsonp = function jsonp(obj) {
 
   // jsonp
   if (typeof callback === 'string' && callback.length !== 0) {
-    this.charset = 'utf-8';
     this.set('X-Content-Type-Options', 'nosniff');
     this.set('Content-Type', 'text/javascript');
 

From a24fd0ca6cfd29329444fddf678bcdd1c08e56ae Mon Sep 17 00:00:00 2001
From: Aaron Clover <aaron.j.clover@gmail.com>
Date: Thu, 20 Jul 2017 21:24:04 +1000
Subject: [PATCH 060/479] Add options to res.download

closes #3327
closes #3370
---
 lib/response.js      | 34 ++++++++++++++++---
 test/res.download.js | 80 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 110 insertions(+), 4 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 9f61648c17b..ae028ae81b6 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -515,19 +515,29 @@ res.sendfile = deprecate.function(res.sendfile,
  * when the data transfer is complete, or when an error has
  * ocurred. Be sure to check `res.headersSent` if you plan to respond.
  *
- * This method uses `res.sendfile()`.
+ * Optionally providing an `options` object to use with `res.sendFile()`.
+ * This function will set the `Content-Disposition` header, overriding
+ * any `Content-Disposition` header passed as header options in order
+ * to set the attachment and filename.
+ *
+ * This method uses `res.sendFile()`.
  *
  * @public
  */
 
-res.download = function download(path, filename, callback) {
+res.download = function download (path, filename, options, callback) {
   var done = callback;
   var name = filename;
+  var opts = options || null
 
-  // support function as second arg
+  // support function as second or third arg
   if (typeof filename === 'function') {
     done = filename;
     name = null;
+    opts = null
+  } else if (typeof options === 'function') {
+    done = options
+    opts = null
   }
 
   // set Content-Disposition when file is sent
@@ -535,10 +545,26 @@ res.download = function download(path, filename, callback) {
     'Content-Disposition': contentDisposition(name || path)
   };
 
+  // merge user-provided headers
+  if (opts && opts.headers) {
+    var keys = Object.keys(opts.headers)
+    for (var i = 0; i < keys.length; i++) {
+      var key = keys[i]
+      if (key.toLowerCase() !== 'content-disposition') {
+        headers[key] = opts.headers[key]
+      }
+    }
+  }
+
+  // merge user-provided options
+  opts = Object.create(opts)
+  opts.headers = headers
+
   // Resolve the full path for sendFile
   var fullPath = resolve(path);
 
-  return this.sendFile(fullPath, { headers: headers }, done);
+  // send file
+  return this.sendFile(fullPath, opts, done)
 };
 
 /**
diff --git a/test/res.download.js b/test/res.download.js
index fad56ee256a..30215bf6764 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -71,6 +71,86 @@ describe('res', function(){
     })
   })
 
+  describe('.download(path, filename, options, fn)', function () {
+    it('should invoke the callback', function (done) {
+      var app = express()
+      var cb = after(2, done)
+      var options = {}
+
+      app.use(function (req, res) {
+        res.download('test/fixtures/user.html', 'document', options, done)
+      })
+
+      request(app)
+      .get('/')
+      .expect(200)
+      .expect('Content-Type', 'text/html; charset=UTF-8')
+      .expect('Content-Disposition', 'attachment; filename="document"')
+      .end(cb)
+    })
+
+    it('should allow options to res.sendFile()', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.download('test/fixtures/.name', 'document', {
+          dotfiles: 'allow',
+          maxAge: '4h'
+        })
+      })
+
+      request(app)
+      .get('/')
+      .expect(200)
+      .expect('Content-Disposition', 'attachment; filename="document"')
+      .expect('Cache-Control', 'public, max-age=14400')
+      .expect('tobi')
+      .end(done)
+    })
+
+    describe('when options.headers contains Content-Disposition', function () {
+      it('should should be ignored', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/user.html', 'document', {
+            headers: {
+              'Content-Type': 'text/x-custom',
+              'Content-Disposition': 'inline'
+            }
+          })
+        })
+
+        request(app)
+        .get('/')
+        .expect(200)
+        .expect('Content-Type', 'text/x-custom')
+        .expect('Content-Disposition', 'attachment; filename="document"')
+        .end(done)
+      })
+
+      it('should should be ignored case-insensitively', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/user.html', 'document', {
+            headers: {
+              'content-type': 'text/x-custom',
+              'content-disposition': 'inline'
+            }
+          })
+        })
+
+        request(app)
+        .get('/')
+        .expect(200)
+        .expect('Content-Type', 'text/x-custom')
+        .expect('Content-Disposition', 'attachment; filename="document"')
+        .end(done)
+      })
+    })
+  })
+
   describe('on failure', function(){
     it('should invoke the callback', function(done){
       var app = express();

From 628438d8d890f3707b8eecf57aeff7d0da348e8e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 11:36:20 -0400
Subject: [PATCH 061/479] deps: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 0a476d67d90..addbdcb7f30 100644
--- a/package.json
+++ b/package.json
@@ -59,18 +59,18 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.18.1",
+    "body-parser": "1.18.2",
     "cookie-parser": "~1.4.3",
-    "cookie-session": "1.3.1",
+    "cookie-session": "1.3.2",
     "ejs": "2.5.7",
     "eslint": "2.13.1",
-    "express-session": "1.15.5",
+    "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
-    "method-override": "2.3.9",
+    "method-override": "2.3.10",
     "mocha": "3.5.3",
-    "morgan": "1.8.2",
+    "morgan": "1.9.0",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
     "should": "13.1.0",

From 715401478516c39ea9b2f855d4109d7d6e1131e0 Mon Sep 17 00:00:00 2001
From: Greg Guthe <gguthe@mozilla.com>
Date: Wed, 5 Apr 2017 17:42:09 -0400
Subject: [PATCH 062/479] Add "escape json" setting for res.json and res.jsonp

closes #3268
closes #3269
---
 History.md        |  1 +
 lib/response.js   | 36 +++++++++++++++++++++++++++++++-----
 test/res.json.js  | 22 ++++++++++++++++++++++
 test/res.jsonp.js | 22 ++++++++++++++++++++++
 4 files changed, 76 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index c2d2595731a..248b1c7a678 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add `"json escape"` setting for `res.json` and `res.jsonp`
   * Improve error message when autoloading invalid view engine
   * Improve error messages when non-function provided as middleware
   * Skip `Buffer` encoding when not generating ETag for small response
diff --git a/lib/response.js b/lib/response.js
index ae028ae81b6..832044be9ae 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -254,9 +254,10 @@ res.json = function json(obj) {
 
   // settings
   var app = this.app;
+  var escape = app.get('json escape')
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = stringify(val, replacer, spaces);
+  var body = stringify(val, replacer, spaces, escape)
 
   // content-type
   if (!this.get('Content-Type')) {
@@ -296,9 +297,10 @@ res.jsonp = function jsonp(obj) {
 
   // settings
   var app = this.app;
+  var escape = app.get('json escape')
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = stringify(val, replacer, spaces);
+  var body = stringify(val, replacer, spaces, escape)
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
@@ -1098,14 +1100,38 @@ function sendfile(res, file, options, callback) {
 }
 
 /**
- * Stringify JSON, like JSON.stringify, but v8 optimized.
+ * Stringify JSON, like JSON.stringify, but v8 optimized, with the
+ * ability to escape characters that can trigger HTML sniffing.
+ *
+ * @param {*} value
+ * @param {function} replaces
+ * @param {number} spaces
+ * @param {boolean} escape
+ * @returns {string}
  * @private
  */
 
-function stringify(value, replacer, spaces) {
+function stringify (value, replacer, spaces, escape) {
   // v8 checks arguments.length for optimizing simple call
   // https://bugs.chromium.org/p/v8/issues/detail?id=4730
-  return replacer || spaces
+  var json = replacer || spaces
     ? JSON.stringify(value, replacer, spaces)
     : JSON.stringify(value);
+
+  if (escape) {
+    json = json.replace(/[<>&]/g, function (c) {
+      switch (c.charCodeAt(0)) {
+        case 0x3c:
+          return '\\u003c'
+        case 0x3e:
+          return '\\u003e'
+        case 0x26:
+          return '\\u0026'
+        default:
+          return c
+      }
+    })
+  }
+
+  return json
 }
diff --git a/test/res.json.js b/test/res.json.js
index 69f6723af54..1041376235c 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -102,6 +102,28 @@ describe('res', function(){
       })
     })
 
+    describe('"json escape" setting', function () {
+      it('should be undefined by default', function () {
+        var app = express()
+        assert.strictEqual(app.get('json escape'), undefined)
+      })
+
+      it('should unicode escape HTML-sniffing characters', function (done) {
+        var app = express()
+
+        app.enable('json escape')
+
+        app.use(function (req, res) {
+          res.json({ '&': '<script>' })
+        })
+
+        request(app)
+        .get('/')
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '{"\\u0026":"\\u003cscript\\u003e"}', done)
+      })
+    })
+
     describe('"json replacer" setting', function(){
       it('should be passed to JSON.stringify()', function(done){
         var app = express();
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 64b41fb9a6b..9b536b541f2 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -242,6 +242,28 @@ describe('res', function(){
       })
     })
 
+    describe('"json escape" setting', function () {
+      it('should be undefined by default', function () {
+        var app = express()
+        assert.strictEqual(app.get('json escape'), undefined)
+      })
+
+      it('should unicode escape HTML-sniffing characters', function (done) {
+        var app = express()
+
+        app.enable('json escape')
+
+        app.use(function (req, res) {
+          res.jsonp({ '&': '\u2028<script>\u2029' })
+        })
+
+        request(app)
+        .get('/?callback=foo')
+        .expect('Content-Type', 'text/javascript; charset=utf-8')
+        .expect(200, /foo\({"\\u0026":"\\u2028\\u003cscript\\u003e\\u2029"}\)/, done)
+      })
+    })
+
     describe('"json replacer" setting', function(){
       it('should be passed to JSON.stringify()', function(done){
         var app = express();

From ddeb71301c98421e0c3cc9fd43e68fdc9b63a45a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 12:32:27 -0400
Subject: [PATCH 063/479] tests: add maxAge option tests for res.sendFile

---
 test/res.sendFile.js | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index ff4b1cb2dd1..9b866471bc7 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -180,6 +180,30 @@ describe('res', function(){
       });
     });
 
+    describe('with "maxAge" option', function () {
+      it('should set cache-control max-age from number', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
+          maxAge: 14400000
+        })
+
+        request(app)
+        .get('/')
+        .expect('Cache-Control', 'public, max-age=14400')
+        .expect(200, done)
+      })
+
+      it('should set cache-control max-age from string', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
+          maxAge: '4h'
+        })
+
+        request(app)
+        .get('/')
+        .expect('Cache-Control', 'public, max-age=14400')
+        .expect(200, done)
+      })
+    })
+
     describe('with "root" option', function () {
       it('should not transfer relative with without', function (done) {
         var app = createApp('test/fixtures/name.txt');

From 41964580a8869d5f094e7379d5672dd75f8491f9 Mon Sep 17 00:00:00 2001
From: Daniel Tschinder <daniel@tschinder.de>
Date: Thu, 28 Sep 2017 11:25:52 +0200
Subject: [PATCH 064/479] deps: send@0.16.0

closes #3431
closes #3435
---
 History.md           |  8 ++++++++
 package.json         |  2 +-
 test/res.sendFile.js | 14 ++++++++++++++
 test/res.type.js     |  3 ++-
 4 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 248b1c7a678..32b9eb19cb6 100644
--- a/History.md
+++ b/History.md
@@ -25,6 +25,14 @@ unreleased
     - perf: reduce overhead when no `X-Forwarded-For` header
   * deps: qs@6.5.1
     - Fix parsing & compacting very deep objects
+  * deps: send@0.16.0
+    - Add 70 new types for file extensions
+    - Add `immutable` option
+    - Fix missing `</html>` in default error & redirects
+    - Set charset as "UTF-8" for .js and .json
+    - Use instance methods on steam to check for listeners
+    - deps: mime@1.4.1
+    - perf: improve path validation speed
   * deps: setprototypeof@1.1.0
   * deps: utils-merge@1.0.1
   * deps: vary@~1.1.2
diff --git a/package.json b/package.json
index addbdcb7f30..2aac075732e 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
-    "send": "0.15.6",
+    "send": "0.16.0",
     "serve-static": "1.12.6",
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 9b866471bc7..4b1f3852f35 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -180,6 +180,20 @@ describe('res', function(){
       });
     });
 
+    describe('with "immutable" option', function () {
+      it('should add immutable cache-control directive', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
+          immutable: true,
+          maxAge: '4h'
+        })
+
+        request(app)
+        .get('/')
+        .expect('Cache-Control', 'public, max-age=14400, immutable')
+        .expect(200, done)
+      })
+    })
+
     describe('with "maxAge" option', function () {
       it('should set cache-control max-age from number', function (done) {
         var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
diff --git a/test/res.type.js b/test/res.type.js
index 7c03ef4c64d..cc1dd08d410 100644
--- a/test/res.type.js
+++ b/test/res.type.js
@@ -13,7 +13,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('Content-Type', 'application/javascript', done);
+      .expect('Content-Type', 'application/javascript; charset=utf-8')
+      .end(done)
     })
 
     it('should default to application/octet-stream', function(done){

From 86f5df00ed921a9e3effdc2e08c038e592a3209b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 13:08:38 -0400
Subject: [PATCH 065/479] deps: serve-static@1.13.0

closes #3197
---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 32b9eb19cb6..fcde7ab82ba 100644
--- a/History.md
+++ b/History.md
@@ -33,6 +33,11 @@ unreleased
     - Use instance methods on steam to check for listeners
     - deps: mime@1.4.1
     - perf: improve path validation speed
+  * deps: serve-static@1.13.0
+    - Add 70 new types for file extensions
+    - Add `immutable` option
+    - Set charset as "UTF-8" for .js and .json
+    - deps: send@0.16.0
   * deps: setprototypeof@1.1.0
   * deps: utils-merge@1.0.1
   * deps: vary@~1.1.2
diff --git a/package.json b/package.json
index 2aac075732e..d30842b2aee 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
     "send": "0.16.0",
-    "serve-static": "1.12.6",
+    "serve-static": "1.13.0",
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From c0136d8b48dd3526c58b2ad8666fb4b12b55116c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 13:22:36 -0400
Subject: [PATCH 066/479] Add express.json and express.urlencoded to parse
 bodies

closes #2211
---
 History.md                         | 1 +
 examples/auth/index.js             | 3 +--
 examples/cookies/index.js          | 3 +--
 examples/mvc/index.js              | 3 +--
 examples/route-separation/index.js | 3 +--
 lib/express.js                     | 7 ++++---
 package.json                       | 2 +-
 test/req.param.js                  | 3 +--
 8 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/History.md b/History.md
index fcde7ab82ba..eae41a82b17 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add `"json escape"` setting for `res.json` and `res.jsonp`
+  * Add `express.json` and `express.urlencoded` to parse bodies
   * Improve error message when autoloading invalid view engine
   * Improve error messages when non-function provided as middleware
   * Skip `Buffer` encoding when not generating ETag for small response
diff --git a/examples/auth/index.js b/examples/auth/index.js
index 084fba79a97..8df77815e3b 100644
--- a/examples/auth/index.js
+++ b/examples/auth/index.js
@@ -3,7 +3,6 @@
  */
 
 var express = require('../..');
-var bodyParser = require('body-parser');
 var hash = require('pbkdf2-password')()
 var path = require('path');
 var session = require('express-session');
@@ -17,7 +16,7 @@ app.set('views', path.join(__dirname, 'views'));
 
 // middleware
 
-app.use(bodyParser.urlencoded({ extended: false }));
+app.use(express.urlencoded({ extended: false }))
 app.use(session({
   resave: false, // don't save session if unmodified
   saveUninitialized: false, // don't create session until something stored
diff --git a/examples/cookies/index.js b/examples/cookies/index.js
index 5d1ba3461c7..34ead527669 100644
--- a/examples/cookies/index.js
+++ b/examples/cookies/index.js
@@ -6,7 +6,6 @@ var express = require('../../');
 var app = module.exports = express();
 var logger = require('morgan');
 var cookieParser = require('cookie-parser');
-var bodyParser = require('body-parser');
 
 // custom log format
 if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
@@ -18,7 +17,7 @@ if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
 app.use(cookieParser('my secret here'));
 
 // parses x-www-form-urlencoded
-app.use(bodyParser.urlencoded({ extended: false }));
+app.use(express.urlencoded({ extended: false }))
 
 app.get('/', function(req, res){
   if (req.cookies.remember) {
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 0d5624b63d3..77885a60ca0 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -6,7 +6,6 @@ var express = require('../..');
 var logger = require('morgan');
 var path = require('path');
 var session = require('express-session');
-var bodyParser = require('body-parser');
 var methodOverride = require('method-override');
 
 var app = module.exports = express();
@@ -43,7 +42,7 @@ app.use(session({
 }));
 
 // parse request bodies (req.body)
-app.use(bodyParser.urlencoded({ extended: true }));
+app.use(express.urlencoded({ extended: true }))
 
 // allow overriding methods in query (?_method=put)
 app.use(methodOverride('_method'));
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index 79e26497f45..65121091348 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -7,7 +7,6 @@ var path = require('path');
 var app = express();
 var logger = require('morgan');
 var cookieParser = require('cookie-parser');
-var bodyParser = require('body-parser');
 var methodOverride = require('method-override');
 var site = require('./site');
 var post = require('./post');
@@ -27,7 +26,7 @@ if (!module.parent) {
 
 app.use(methodOverride('_method'));
 app.use(cookieParser());
-app.use(bodyParser.urlencoded({ extended: true }));
+app.use(express.urlencoded({ extended: true }))
 app.use(express.static(path.join(__dirname, 'public')));
 
 // General
diff --git a/lib/express.js b/lib/express.js
index 187e4e2d7ca..485a8fc08de 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -12,6 +12,7 @@
  * Module dependencies.
  */
 
+var bodyParser = require('body-parser')
 var EventEmitter = require('events').EventEmitter;
 var mixin = require('merge-descriptors');
 var proto = require('./application');
@@ -74,16 +75,16 @@ exports.Router = Router;
  * Expose middleware
  */
 
+exports.json = bodyParser.json
 exports.query = require('./middleware/query');
 exports.static = require('serve-static');
+exports.urlencoded = bodyParser.urlencoded
 
 /**
  * Replace removed middleware with an appropriate error message.
  */
 
-[
-  'json',
-  'urlencoded',
+;[
   'bodyParser',
   'compress',
   'cookieSession',
diff --git a/package.json b/package.json
index d30842b2aee..f20c3b9dca8 100644
--- a/package.json
+++ b/package.json
@@ -29,6 +29,7 @@
   "dependencies": {
     "accepts": "~1.3.4",
     "array-flatten": "1.1.1",
+    "body-parser": "1.18.2",
     "content-disposition": "0.5.2",
     "content-type": "~1.0.4",
     "cookie": "0.3.1",
@@ -59,7 +60,6 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.18.2",
     "cookie-parser": "~1.4.3",
     "cookie-session": "1.3.2",
     "ejs": "2.5.7",
diff --git a/test/req.param.js b/test/req.param.js
index 1e827f03058..89f0295cd9d 100644
--- a/test/req.param.js
+++ b/test/req.param.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , bodyParser = require('body-parser')
 
 describe('req', function(){
   describe('.param(name, default)', function(){
@@ -34,7 +33,7 @@ describe('req', function(){
     it('should check req.body', function(done){
       var app = express();
 
-      app.use(bodyParser.json());
+      app.use(express.json())
 
       app.use(function(req, res){
         res.end(req.param('name'));

From 8d4ceb623d8130e9a4ea784bdbe80ecf2d9d51c9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 13:55:15 -0400
Subject: [PATCH 067/479] docs: add more information to installation

---
 Readme.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Readme.md b/Readme.md
index 17326615776..3cd2203250c 100644
--- a/Readme.md
+++ b/Readme.md
@@ -21,10 +21,22 @@ app.listen(3000)
 
 ## Installation
 
+This is a [Node.js](https://nodejs.org/en/) module available through the
+[npm registry](https://www.npmjs.com/).
+
+Before installing, [download and install Node.js](https://nodejs.org/en/download/).
+Node.js 0.10 or higher is required.
+
+Installation is done using the
+[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+
 ```bash
 $ npm install express
 ```
 
+Follow [our installing guide](http://expressjs.com/en/starter/installing.html)
+for more information.
+
 ## Features
 
   * Robust routing

From f974d22c66d3cd91634ddaba1ef8bcaa8e49daf4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 13:57:23 -0400
Subject: [PATCH 068/479] 4.16.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index eae41a82b17..c4be93f728c 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.0 / 2017-09-28
+===================
 
   * Add `"json escape"` setting for `res.json` and `res.jsonp`
   * Add `express.json` and `express.urlencoded` to parse bodies
diff --git a/package.json b/package.json
index f20c3b9dca8..33a667bd4a6 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.5",
+  "version": "4.16.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 6d9b13cceda6ee24a53dab01d9db9d7588ac66b4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Sep 2017 15:56:55 -0400
Subject: [PATCH 069/479] deps: send@0.16.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c4be93f728c..3fd05fb0df5 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: send@0.16.1
+
 4.16.0 / 2017-09-28
 ===================
 
diff --git a/package.json b/package.json
index 33a667bd4a6..29103da521b 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
-    "send": "0.16.0",
+    "send": "0.16.1",
     "serve-static": "1.13.0",
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",

From 6f823e409c1dcaa338df9592df98a2ec396b2143 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Sep 2017 16:12:06 -0400
Subject: [PATCH 070/479] deps: serve-static@1.13.1

closes #3436
---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3fd05fb0df5..b49bdbcfed7 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * deps: send@0.16.1
+  * deps: serve-static@1.13.1
+    - Fix regression when `root` is incorrectly set to a file
+    - deps: send@0.16.1
 
 4.16.0 / 2017-09-28
 ===================
diff --git a/package.json b/package.json
index 29103da521b..ca0d649f4e5 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
     "send": "0.16.1",
-    "serve-static": "1.13.0",
+    "serve-static": "1.13.1",
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From e3f7f51f5f5475ca1ad091b1f8b7293f79467d29 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Sep 2017 16:23:23 -0400
Subject: [PATCH 071/479] 4.16.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b49bdbcfed7..df3280cb7bf 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.1 / 2017-09-29
+===================
 
   * deps: send@0.16.1
   * deps: serve-static@1.13.1
diff --git a/package.json b/package.json
index ca0d649f4e5..3b03f12d922 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.0",
+  "version": "4.16.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From de129c289dc17d3039c2655c050716b0eff9b0f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Oct 2017 00:48:29 -0400
Subject: [PATCH 072/479] tests: run mocha with --no-exit to detect hangs

closes #3439
---
 package.json             |  8 ++++----
 test/middleware.basic.js |  2 +-
 test/res.format.js       | 11 +++++++----
 test/res.sendFile.js     | 30 ++++++++++++++++++------------
 4 files changed, 30 insertions(+), 21 deletions(-)

diff --git a/package.json b/package.json
index 3b03f12d922..6bfc610ccfc 100644
--- a/package.json
+++ b/package.json
@@ -90,9 +90,9 @@
   ],
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"
+    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks --no-exit test/ test/acceptance/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks --no-exit test/ test/acceptance/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks --no-exit test/ test/acceptance/",
+    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks --no-exit test/ test/acceptance/"
   }
 }
diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index 28a4dd18f2e..ce59589230b 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -28,7 +28,7 @@ describe('middleware', function(){
         });
       });
 
-      request(app.listen())
+      request(app)
       .get('/')
       .set('Content-Type', 'application/json')
       .send('{"foo":"bar"}')
diff --git a/test/res.format.js b/test/res.format.js
index 3c1d095b426..1c1d077e587 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -1,4 +1,5 @@
 
+var after = require('after')
 var express = require('../')
   , request = require('supertest')
   , assert = require('assert');
@@ -168,21 +169,23 @@ function test(app) {
     .expect('hey', done);
   })
 
-  it('should set the correct  charset for the Content-Type', function() {
+  it('should set the correct charset for the Content-Type', function (done) {
+    var cb = after(3, done)
+
     request(app)
     .get('/')
     .set('Accept', 'text/html')
-    .expect('Content-Type', 'text/html; charset=utf-8');
+    .expect('Content-Type', 'text/html; charset=utf-8', cb)
 
     request(app)
     .get('/')
     .set('Accept', 'text/plain')
-    .expect('Content-Type', 'text/plain; charset=utf-8');
+    .expect('Content-Type', 'text/plain; charset=utf-8', cb)
 
     request(app)
     .get('/')
     .set('Accept', 'application/json')
-    .expect('Content-Type', 'application/json');
+    .expect('Content-Type', 'application/json; charset=utf-8', cb)
   })
 
   it('should Vary: Accept', function(done){
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 4b1f3852f35..ccec3f40cfe 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -102,7 +102,7 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'));
-          cb();
+          server.close(cb)
         });
         test.abort();
       });
@@ -112,7 +112,8 @@ describe('res', function(){
         cb();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -264,13 +265,14 @@ describe('res', function(){
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
             should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
-            cb();
+            server.close(cb)
           });
         });
         test.abort();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -283,13 +285,14 @@ describe('res', function(){
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
             should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
-            cb();
+            server.close(cb)
           });
         });
         test.abort();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -388,13 +391,14 @@ describe('res', function(){
           res.sendfile('test/fixtures/name.txt', function (err) {
             should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
-            cb();
+            server.close(cb)
           });
         });
         test.abort();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -407,13 +411,14 @@ describe('res', function(){
           res.sendfile('test/fixtures/name.txt', function (err) {
             should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
-            cb();
+            server.close(cb)
           });
         });
         test.abort();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -629,7 +634,7 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendfile(path.resolve(fixtures, 'name.txt'));
-          cb();
+          server.close(cb)
         });
         test.abort();
       });
@@ -639,7 +644,8 @@ describe('res', function(){
         cb();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 

From 48aba21ea4bcf0dec962514553f6e6326f942dc6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 4 Oct 2017 23:09:22 -0400
Subject: [PATCH 073/479] docs: add missing history for res.download change

---
 History.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/History.md b/History.md
index df3280cb7bf..2859c77c74a 100644
--- a/History.md
+++ b/History.md
@@ -11,6 +11,7 @@
 
   * Add `"json escape"` setting for `res.json` and `res.jsonp`
   * Add `express.json` and `express.urlencoded` to parse bodies
+  * Add `options` argument to `res.download`
   * Improve error message when autoloading invalid view engine
   * Improve error messages when non-function provided as middleware
   * Skip `Buffer` encoding when not generating ETag for small response

From b7817ab1b0bbadabe79fc88819c8338838ead707 Mon Sep 17 00:00:00 2001
From: David Wood <bitprobe@gmail.com>
Date: Mon, 9 Oct 2017 14:41:06 -0500
Subject: [PATCH 074/479] Fix TypeError in res.send when given Buffer and ETag
 header set

fixes #3445
---
 History.md       |  5 +++++
 lib/response.js  | 10 +++++-----
 test/res.send.js | 13 +++++++++++++
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 2859c77c74a..f51da8dfb36 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set
+
 4.16.1 / 2017-09-29
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index 832044be9ae..9c1796d37b3 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -178,17 +178,17 @@ res.send = function send(body) {
   // populate Content-Length
   var len
   if (chunk !== undefined) {
-    if (!generateETag && chunk.length < 1000) {
+    if (Buffer.isBuffer(chunk)) {
+      // get length of Buffer
+      len = chunk.length
+    } else if (!generateETag && chunk.length < 1000) {
       // just calculate length when no ETag + small chunk
       len = Buffer.byteLength(chunk, encoding)
-    } else if (!Buffer.isBuffer(chunk)) {
+    } else {
       // convert chunk to Buffer and calculate
       chunk = Buffer.from(chunk, encoding)
       encoding = undefined;
       len = chunk.length
-    } else {
-      // get length of Buffer
-      len = chunk.length
     }
 
     this.set('Content-Length', len);
diff --git a/test/res.send.js b/test/res.send.js
index 7aa8d7d90e2..24105542481 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -216,6 +216,19 @@ describe('res', function(){
       .expect('Content-Type', 'text/plain; charset=utf-8')
       .expect(200, 'hey', done);
     })
+
+    it('should not override ETag', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.type('text/plain').set('ETag', '"foo"').send(Buffer.from('hey'))
+      })
+
+      request(app)
+      .get('/')
+      .expect('ETag', '"foo"')
+      .expect(200, 'hey', done)
+    })
   })
 
   describe('.send(Object)', function(){

From b97faff6e2aa4d34d79485fe4331cb0eec13ad57 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Oct 2017 22:43:23 -0400
Subject: [PATCH 075/479] perf: skip parsing of entire "X-Forwarded-Proto"
 header

---
 History.md     | 1 +
 lib/request.js | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index f51da8dfb36..f7313199d43 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set
+  * perf: skip parsing of entire `X-Forwarded-Proto` header
 
 4.16.1 / 2017-09-29
 ===================
diff --git a/lib/request.js b/lib/request.js
index 3432e6776fe..8bb86a9acc4 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -315,8 +315,12 @@ defineGetter(req, 'protocol', function protocol(){
 
   // Note: X-Forwarded-Proto is normally only ever a
   //       single value, but this is to be safe.
-  proto = this.get('X-Forwarded-Proto') || proto;
-  return proto.split(/\s*,\s*/)[0];
+  var header = this.get('X-Forwarded-Proto') || proto
+  var index = header.indexOf(',')
+
+  return index !== -1
+    ? header.substring(0, index).trim()
+    : header.trim()
 });
 
 /**

From 351396f971280ab79faddcf9782ea50f4e88358d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Oct 2017 22:55:18 -0400
Subject: [PATCH 076/479] 4.16.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index f7313199d43..fbf59a23413 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.2 / 2017-10-09
+===================
 
   * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set
   * perf: skip parsing of entire `X-Forwarded-Proto` header
diff --git a/package.json b/package.json
index 6bfc610ccfc..134ca2a0c1b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.1",
+  "version": "4.16.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 53bee2506debf01d9f6e884d1fc09b86d001f0e2 Mon Sep 17 00:00:00 2001
From: Yaman Jain <yamanjain007@gmail.com>
Date: Wed, 1 Nov 2017 14:49:59 +0530
Subject: [PATCH 077/479] examples: use https github url

closes #3465
---
 examples/web-service/index.js  | 6 +++---
 test/acceptance/web-service.js | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 41747cfdc7f..5a603a1023f 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -49,9 +49,9 @@ var apiKeys = ['foo', 'bar', 'baz'];
 // these two objects will serve as our faux database
 
 var repos = [
-    { name: 'express', url: 'http://github.com/expressjs/express' }
-  , { name: 'stylus', url: 'http://github.com/learnboost/stylus' }
-  , { name: 'cluster', url: 'http://github.com/learnboost/cluster' }
+  { name: 'express', url: 'https://github.com/expressjs/express' },
+  { name: 'stylus', url: 'https://github.com/learnboost/stylus' },
+  { name: 'cluster', url: 'https://github.com/learnboost/cluster' }
 ];
 
 var users = [
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index 521fa9fa28d..fa2c10bfdb4 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -53,7 +53,7 @@ describe('web-service', function(){
         .get('/api/repos?api-key=foo')
         .expect('Content-Type', 'application/json; charset=utf-8')
         .expect(/"name":"express"/)
-        .expect(/"url":"http:\/\/github.com\/expressjs\/express"/)
+        .expect(/"url":"https:\/\/github.com\/expressjs\/express"/)
         .expect(200, done)
       })
     })
@@ -82,7 +82,7 @@ describe('web-service', function(){
         .get('/api/user/loki/repos?api-key=foo')
         .expect('Content-Type', 'application/json; charset=utf-8')
         .expect(/"name":"stylus"/)
-        .expect(/"url":"http:\/\/github.com\/learnboost\/stylus"/)
+        .expect(/"url":"https:\/\/github.com\/learnboost\/stylus"/)
         .expect(200, done)
       })
 

From 950f4423f0f881e40b1f68339054c209aec6d0e3 Mon Sep 17 00:00:00 2001
From: chainhelen <chainhelen@gmail.com>
Date: Wed, 11 Oct 2017 10:42:11 +0800
Subject: [PATCH 078/479] tests: separate res.send() chain test

closes #3448
---
 test/res.send.js | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/test/res.send.js b/test/res.send.js
index 24105542481..13658fe6b01 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var Buffer = require('safe-buffer').Buffer
 var express = require('..');
 var methods = require('methods');
@@ -54,7 +55,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.send(201).should.equal(res);
+        res.send(201)
       });
 
       request(app)
@@ -354,6 +355,18 @@ describe('res', function(){
     .expect('{"foo":"bar"}', done);
   })
 
+  it('should be chainable', function (done) {
+    var app = express()
+
+    app.use(function (req, res) {
+      assert.equal(res.send('hey'), res)
+    })
+
+    request(app)
+    .get('/')
+    .expect(200, 'hey', done)
+  })
+
   describe('"etag" setting', function () {
     describe('when enabled', function () {
       it('should send ETag', function (done) {

From 187d1f57c973e93310066e29a493e150e57c6ae5 Mon Sep 17 00:00:00 2001
From: David Wu <david10608@gmail.com>
Date: Wed, 3 Jan 2018 00:47:52 +0100
Subject: [PATCH 079/479] docs: remove gratipay badges

closes #3524
---
 Readme.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index 3cd2203250c..582e8958c59 100644
--- a/Readme.md
+++ b/Readme.md
@@ -127,9 +127,9 @@ $ npm test
 
 ## People
 
-The original author of Express is [TJ Holowaychuk](https://github.com/tj) [![TJ's Gratipay][gratipay-image-visionmedia]][gratipay-url-visionmedia]
+The original author of Express is [TJ Holowaychuk](https://github.com/tj)
 
-The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson) [![Doug's Gratipay][gratipay-image-dougwilson]][gratipay-url-dougwilson]
+The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson)
 
 [List of all contributors](https://github.com/expressjs/express/graphs/contributors)
 

From a743d5be4d91cf2b430479c6b481f00c19f2ba73 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 2 Jan 2018 19:45:25 -0500
Subject: [PATCH 080/479] build: marked@0.3.9

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 134ca2a0c1b..27e1a89cc39 100644
--- a/package.json
+++ b/package.json
@@ -67,7 +67,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.3.6",
+    "marked": "0.3.9",
     "method-override": "2.3.10",
     "mocha": "3.5.3",
     "morgan": "1.9.0",

From b49af6a6743acc7cc875b67f090f553b63a184e8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 2 Jan 2018 19:46:31 -0500
Subject: [PATCH 081/479] build: should@13.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 27e1a89cc39..666f141d31c 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
     "morgan": "1.9.0",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "13.1.0",
+    "should": "13.2.0",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From 1780ed10918021c54dd36e75476ca52b1f931116 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 2 Jan 2018 21:47:13 -0500
Subject: [PATCH 082/479] build: Node.js@6.12

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 855168ff540..5e18eb6f846 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.11"
+  - "6.12"
   - "7.10"
   - "8.4"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index 193660af715..cd943573ac6 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.11"
+    - nodejs_version: "6.12"
     - nodejs_version: "7.10"
     - nodejs_version: "8.4"
 cache:

From fe0bc4082d799ff95d6010e42828af30e65a9666 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 2 Jan 2018 22:38:09 -0500
Subject: [PATCH 083/479] build: Node.js@8.9

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 5e18eb6f846..17b7c7cea0f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.12"
   - "7.10"
-  - "8.4"
+  - "8.9"
 matrix:
   include:
     - node_js: "8"
diff --git a/appveyor.yml b/appveyor.yml
index cd943573ac6..ab65453be3b 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,7 +9,7 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.12"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.4"
+    - nodejs_version: "8.9"
 cache:
   - node_modules
 install:

From b4020ec92bfa39c6e279b94cfb183472f06fdf83 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 19:09:25 -0500
Subject: [PATCH 084/479] build: should@13.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 666f141d31c..f1306e578a9 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
     "morgan": "1.9.0",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "13.2.0",
+    "should": "13.2.1",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From 086e56f1c4d9973fdb5eb1e21e79e10d4e002393 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 19:12:34 -0500
Subject: [PATCH 085/479] build: marked@0.3.12

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f1306e578a9..8ab44ef3dc8 100644
--- a/package.json
+++ b/package.json
@@ -67,7 +67,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.3.9",
+    "marked": "0.3.12",
     "method-override": "2.3.10",
     "mocha": "3.5.3",
     "morgan": "1.9.0",

From 68e824cbff0cc58643a3f40e99299f600667072d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 19:19:03 -0500
Subject: [PATCH 086/479] build: remove Node.js 8 nightly build

---
 .travis.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 17b7c7cea0f..a83b962abe2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,8 +12,6 @@ node_js:
   - "8.9"
 matrix:
   include:
-    - node_js: "8"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "9"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:

From f448a9668515077937437d86e9e44421bcf2a093 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 23:46:11 -0500
Subject: [PATCH 087/479] deps: depd@~1.1.2

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fbf59a23413..02ffc65d44b 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: depd@~1.1.2
+    - perf: remove argument reassignment
+
 4.16.2 / 2017-10-09
 ===================
 
diff --git a/package.json b/package.json
index 8ab44ef3dc8..414280f8d92 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
-    "depd": "~1.1.1",
+    "depd": "~1.1.2",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",

From 323572610b292d2351ad4c60c2b7b9ce4d7ad3ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 23:50:41 -0500
Subject: [PATCH 088/479] deps: encodeurl@~1.0.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 02ffc65d44b..fd49c6b359c 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: depd@~1.1.2
     - perf: remove argument reassignment
+  * deps: encodeurl@~1.0.2
+    - Fix encoding `%` as last character
 
 4.16.2 / 2017-10-09
 ===================
diff --git a/package.json b/package.json
index 414280f8d92..f9b9a827e26 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~1.1.2",
-    "encodeurl": "~1.0.1",
+    "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
     "finalhandler": "1.1.0",

From c6f12a897184e614171121dfdb31bdc03859db0b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jan 2018 00:00:22 -0500
Subject: [PATCH 089/479] deps: statuses@~1.4.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fd49c6b359c..cce0fad97ea 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
     - Fix encoding `%` as last character
+  * deps: statuses@~1.4.0
 
 4.16.2 / 2017-10-09
 ===================
diff --git a/package.json b/package.json
index f9b9a827e26..4f341832d2f 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "send": "0.16.1",
     "serve-static": "1.13.1",
     "setprototypeof": "1.1.0",
-    "statuses": "~1.3.1",
+    "statuses": "~1.4.0",
     "type-is": "~1.6.15",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"

From f8fba68ec0e6e986eea4dc3bfe39dbe09dccf5d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jan 2018 00:20:15 -0500
Subject: [PATCH 090/479] tests: use supertest expect to test body

---
 test/acceptance/error-pages.js | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/test/acceptance/error-pages.js b/test/acceptance/error-pages.js
index 9af950178da..48feb3fb466 100644
--- a/test/acceptance/error-pages.js
+++ b/test/acceptance/error-pages.js
@@ -52,10 +52,7 @@ describe('error-pages', function(){
         request(app)
         .get('/404')
         .set('Accept','application/json')
-        .end(function(err, res){
-          res.body.should.eql({ error: 'Not found' });
-          done()
-        })
+        .expect(404, { error: 'Not found' }, done)
       })
     })
 

From 94a6cbfbfe672e4abb95bebcf266ed5dc65f336d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jan 2018 00:28:25 -0500
Subject: [PATCH 091/479] tests: remove unnecessary functions for supertest

---
 test/req.xhr.js | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/test/req.xhr.js b/test/req.xhr.js
index 1bbc247104d..94af9170cb3 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -15,10 +15,7 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'xmlhttprequest')
-      .expect(200)
-      .end(function(err, res){
-        done(err);
-      })
+      .expect(200, done)
     })
 
     it('should case-insensitive', function(done){
@@ -32,10 +29,7 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'XMLHttpRequest')
-      .expect(200)
-      .end(function(err, res){
-        done(err);
-      })
+      .expect(200, done)
     })
 
     it('should return false otherwise', function(done){
@@ -49,10 +43,7 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'blahblah')
-      .expect(200)
-      .end(function(err, res){
-        done(err);
-      })
+      .expect(200, done)
     })
 
     it('should return false when not present', function(done){
@@ -65,10 +56,7 @@ describe('req', function(){
 
       request(app)
       .get('/')
-      .expect(200)
-      .end(function(err, res){
-        done(err);
-      })
+      .expect(200, done)
     })
   })
 })

From 276a80895c6bef11b0819c46525376ad16c68517 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 Feb 2018 13:09:25 -0500
Subject: [PATCH 092/479] deps: send@0.16.2

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index cce0fad97ea..5161e8554c2 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,11 @@ unreleased
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
     - Fix encoding `%` as last character
+  * deps: send@0.16.2
+    - Fix incorrect end tag in default error & redirects
+    - deps: depd@~1.1.2
+    - deps: encodeurl@~1.0.2
+    - deps: statuses@~1.4.0
   * deps: statuses@~1.4.0
 
 4.16.2 / 2017-10-09
diff --git a/package.json b/package.json
index 4f341832d2f..6b2e0b9d861 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
-    "send": "0.16.1",
+    "send": "0.16.2",
     "serve-static": "1.13.1",
     "setprototypeof": "1.1.0",
     "statuses": "~1.4.0",

From cbaa04629a90aff76774b59cd055ff8c6e642030 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 Feb 2018 13:20:09 -0500
Subject: [PATCH 093/479] deps: serve-static@1.13.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5161e8554c2..756198b4398 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,10 @@ unreleased
     - deps: depd@~1.1.2
     - deps: encodeurl@~1.0.2
     - deps: statuses@~1.4.0
+  * deps: serve-static@1.13.2
+    - Fix incorrect end tag in redirects
+    - deps: encodeurl@~1.0.2
+    - deps: send@0.16.2
   * deps: statuses@~1.4.0
 
 4.16.2 / 2017-10-09
diff --git a/package.json b/package.json
index 6b2e0b9d861..b86eb6f1a6f 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
     "send": "0.16.2",
-    "serve-static": "1.13.1",
+    "serve-static": "1.13.2",
     "setprototypeof": "1.1.0",
     "statuses": "~1.4.0",
     "type-is": "~1.6.15",

From 98b0b66b6c46882c3fa54f04185254ab53b38570 Mon Sep 17 00:00:00 2001
From: Yuta Hiroto <git@about-hiroppy.com>
Date: Tue, 13 Feb 2018 17:26:27 +0900
Subject: [PATCH 094/479] build: use yaml eslint configuration

closes #3561
---
 .eslintrc     | 8 --------
 .eslintrc.yml | 7 +++++++
 2 files changed, 7 insertions(+), 8 deletions(-)
 delete mode 100644 .eslintrc
 create mode 100644 .eslintrc.yml

diff --git a/.eslintrc b/.eslintrc
deleted file mode 100644
index ad9c0ce9eb7..00000000000
--- a/.eslintrc
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "rules": {
-    "eol-last": "error",
-    "indent": ["error", 2, { "SwitchCase": 1 }],
-    "no-trailing-spaces": "error",
-    "no-unused-vars": ["error", { "vars": "all", "args": "none", "ignoreRestSiblings": true }]
-  }
-}
diff --git a/.eslintrc.yml b/.eslintrc.yml
new file mode 100644
index 00000000000..1d9b154a6a7
--- /dev/null
+++ b/.eslintrc.yml
@@ -0,0 +1,7 @@
+root: true
+
+rules:
+  eol-last: error
+  indent: [error, 2, { SwitchCase: 1 }]
+  no-trailing-spaces: error
+  no-unused-vars: [error, { vars: all, args: none, ignoreRestSiblings: true }]

From 80e64691e1972dccc79def005190da33c641d51e Mon Sep 17 00:00:00 2001
From: Steven Anthony <stevenanthonyrevo@live.com>
Date: Thu, 28 Dec 2017 23:29:38 -0500
Subject: [PATCH 095/479] examples: add full urls to web-service example

closes #3519
---
 examples/web-service/index.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 5a603a1023f..0e2cbb7cde0 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -69,14 +69,17 @@ var userRepos = {
 // we now can assume the api key is valid,
 // and simply expose the data
 
+// example: http://localhost:3000/api/users/?api-key=foo
 app.get('/api/users', function(req, res, next){
   res.send(users);
 });
 
+// example: http://localhost:3000/api/repos/?api-key=foo
 app.get('/api/repos', function(req, res, next){
   res.send(repos);
 });
 
+// example: http://localhost:3000/api/user/tobi/repos/?api-key=foo
 app.get('/api/user/:name/repos', function(req, res, next){
   var name = req.params.name;
   var user = userRepos[name];

From 972ada9079b715f9e806ef04ec73311fb46bded0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Feb 2018 17:14:48 -0500
Subject: [PATCH 096/479] tests: remove duplicate block in router test

---
 test/Router.js | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/test/Router.js b/test/Router.js
index 057ce443df4..e7b8e713fee 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -7,9 +7,6 @@ var express = require('../')
 
 describe('Router', function(){
   it('should return a function with router methods', function() {
-    var router = Router();
-    assert(typeof router == 'function');
-
     var router = new Router();
     assert(typeof router == 'function');
 

From 40e04ec7a6d365a7e083b0fdf7f9d2c7afc036a0 Mon Sep 17 00:00:00 2001
From: Alejandro Estrada <estrada9166@hotmail.com>
Date: Sun, 21 Jan 2018 20:14:47 -0500
Subject: [PATCH 097/479] lint: remove usages of "=="

closes #3540
---
 .eslintrc.yml                      | 1 +
 examples/auth/index.js             | 2 +-
 examples/cookies/index.js          | 2 +-
 examples/error-pages/index.js      | 4 ++--
 examples/error/index.js            | 2 +-
 examples/route-map/index.js        | 2 +-
 examples/route-middleware/index.js | 4 ++--
 examples/search/public/client.js   | 2 +-
 examples/view-locals/index.js      | 2 +-
 test/Router.js                     | 8 ++++----
 test/app.param.js                  | 2 +-
 test/app.router.js                 | 4 ++--
 test/req.signedCookies.js          | 2 +-
 test/res.format.js                 | 6 +++---
 test/res.json.js                   | 2 +-
 test/res.jsonp.js                  | 2 +-
 16 files changed, 24 insertions(+), 23 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index 1d9b154a6a7..5b11e9fd844 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -2,6 +2,7 @@ root: true
 
 rules:
   eol-last: error
+  eqeqeq: [error, allow-null]
   indent: [error, 2, { SwitchCase: 1 }]
   no-trailing-spaces: error
   no-unused-vars: [error, { vars: all, args: none, ignoreRestSiblings: true }]
diff --git a/examples/auth/index.js b/examples/auth/index.js
index 8df77815e3b..b8e854300cb 100644
--- a/examples/auth/index.js
+++ b/examples/auth/index.js
@@ -65,7 +65,7 @@ function authenticate(name, pass, fn) {
   // found the user
   hash({ password: pass, salt: user.salt }, function (err, pass, salt, hash) {
     if (err) return fn(err);
-    if (hash == user.hash) return fn(null, user);
+    if (hash === user.hash) return fn(null, user)
     fn(new Error('invalid password'));
   });
 }
diff --git a/examples/cookies/index.js b/examples/cookies/index.js
index 34ead527669..93515e59612 100644
--- a/examples/cookies/index.js
+++ b/examples/cookies/index.js
@@ -8,7 +8,7 @@ var logger = require('morgan');
 var cookieParser = require('cookie-parser');
 
 // custom log format
-if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
+if (process.env.NODE_ENV !== 'test') app.use(logger(':method :url'))
 
 // parses request cookies, populating
 // req.cookies and req.signedCookies
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 790f6e30dfd..44333cb08fc 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -6,7 +6,7 @@ var express = require('../../');
 var path = require('path');
 var app = module.exports = express();
 var logger = require('morgan');
-var silent = 'test' == process.env.NODE_ENV;
+var silent = process.env.NODE_ENV === 'test'
 
 // general config
 app.set('views', path.join(__dirname, 'views'));
@@ -19,7 +19,7 @@ app.enable('verbose errors');
 
 // disable them in production
 // use $ NODE_ENV=production node examples/error-pages
-if ('production' == app.settings.env) app.disable('verbose errors');
+if (app.settings.env === 'production') app.disable('verbose errors')
 
 silent || app.use(logger('dev'));
 
diff --git a/examples/error/index.js b/examples/error/index.js
index 94b3b4a4da3..07814d85201 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -5,7 +5,7 @@
 var express = require('../../');
 var logger = require('morgan');
 var app = module.exports = express();
-var test = app.get('env') == 'test';
+var test = app.get('env') === 'test'
 
 if (!test) app.use(logger('dev'));
 
diff --git a/examples/route-map/index.js b/examples/route-map/index.js
index 9468dd36678..f2b192ac1d9 100644
--- a/examples/route-map/index.js
+++ b/examples/route-map/index.js
@@ -4,7 +4,7 @@
 
 var express = require('../../lib/express');
 
-var verbose = process.env.NODE_ENV != 'test';
+var verbose = process.env.NODE_ENV !== 'test'
 
 var app = module.exports = express();
 
diff --git a/examples/route-middleware/index.js b/examples/route-middleware/index.js
index 2d26a33a0f1..84407318870 100644
--- a/examples/route-middleware/index.js
+++ b/examples/route-middleware/index.js
@@ -34,7 +34,7 @@ function loadUser(req, res, next) {
 function andRestrictToSelf(req, res, next) {
   // If our authenticated user is the user we are viewing
   // then everything is fine :)
-  if (req.authenticatedUser.id == req.user.id) {
+  if (req.authenticatedUser.id === req.user.id) {
     next();
   } else {
     // You may want to implement specific exceptions
@@ -47,7 +47,7 @@ function andRestrictToSelf(req, res, next) {
 
 function andRestrictTo(role) {
   return function(req, res, next) {
-    if (req.authenticatedUser.role == role) {
+    if (req.authenticatedUser.role === role) {
       next();
     } else {
       next(new Error('Unauthorized'));
diff --git a/examples/search/public/client.js b/examples/search/public/client.js
index a7eeb6a75af..75c37d8e00e 100644
--- a/examples/search/public/client.js
+++ b/examples/search/public/client.js
@@ -5,7 +5,7 @@ search.addEventListener('keyup', function(){
   var xhr = new XMLHttpRequest;
   xhr.open('GET', '/search/' + search.value, true);
   xhr.onreadystatechange = function(){
-    if (4 == xhr.readyState) {
+    if (xhr.readyState === 4) {
       code.textContent = xhr.responseText;
     }
   };
diff --git a/examples/view-locals/index.js b/examples/view-locals/index.js
index 3814e6e4962..cb41509606b 100644
--- a/examples/view-locals/index.js
+++ b/examples/view-locals/index.js
@@ -13,7 +13,7 @@ app.set('view engine', 'ejs');
 // filter ferrets only
 
 function ferrets(user) {
-  return user.species == 'ferret';
+  return user.species === 'ferret'
 }
 
 // naive nesting approach,
diff --git a/test/Router.js b/test/Router.js
index e7b8e713fee..47c5e65481a 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -8,11 +8,11 @@ var express = require('../')
 describe('Router', function(){
   it('should return a function with router methods', function() {
     var router = new Router();
-    assert(typeof router == 'function');
+    assert(typeof router === 'function')
 
-    assert(typeof router.get == 'function');
-    assert(typeof router.handle == 'function');
-    assert(typeof router.use == 'function');
+    assert(typeof router.get === 'function')
+    assert(typeof router.handle === 'function')
+    assert(typeof router.use === 'function')
   });
 
   it('should support .use of other routers', function(done){
diff --git a/test/app.param.js b/test/app.param.js
index ba43e46f8e3..8785567751f 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -8,7 +8,7 @@ describe('app', function(){
       var app = express();
 
       app.param(function(name, regexp){
-        if (Object.prototype.toString.call(regexp) == '[object RegExp]') { // See #1557
+        if (Object.prototype.toString.call(regexp) === '[object RegExp]') { // See #1557
           return function(req, res, next, val){
             var captures;
             if (captures = regexp.exec(String(val))) {
diff --git a/test/app.router.js b/test/app.router.js
index 28561c2fbcd..c4bfc9b952a 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -41,7 +41,7 @@ describe('app.router', function(){
         var app = express();
 
         app[method]('/foo', function(req, res){
-          if ('head' == method) {
+          if (method === 'head') {
             res.end();
           } else {
             res.end(method);
@@ -50,7 +50,7 @@ describe('app.router', function(){
 
         request(app)
         [method]('/foo')
-        .expect('head' == method ? '' : method, done);
+        .expect(method === 'head' ? '' : method, done)
       })
 
       it('should reject numbers for app.' + method, function(){
diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index 73880b01b4c..a55f81b22c5 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -11,7 +11,7 @@ describe('req', function(){
       app.use(cookieParser('secret'));
 
       app.use(function(req, res){
-        if ('/set' == req.path) {
+        if (req.path === '/set') {
           res.cookie('obj', { foo: 'bar' }, { signed: true });
           res.end();
         } else {
diff --git a/test/res.format.js b/test/res.format.js
index 1c1d077e587..076b78d7386 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -17,9 +17,9 @@ app1.use(function(req, res, next){
     },
 
     'application/json': function(a, b, c){
-      assert(req == a);
-      assert(res == b);
-      assert(next == c);
+      assert(req === a)
+      assert(res === b)
+      assert(next === c)
       res.send({ message: 'hey' });
     }
   });
diff --git a/test/res.json.js b/test/res.json.js
index 1041376235c..a82a127546e 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -129,7 +129,7 @@ describe('res', function(){
         var app = express();
 
         app.set('json replacer', function(key, val){
-          return '_' == key[0]
+          return key[0] === '_'
             ? undefined
             : val;
         });
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 9b536b541f2..40dba100f92 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -269,7 +269,7 @@ describe('res', function(){
         var app = express();
 
         app.set('json replacer', function(key, val){
-          return '_' == key[0]
+          return key[0] === '_'
             ? undefined
             : val;
         });

From f3c5f7ee29e9b935e95e628e002ee9eaebda176a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Feb 2018 21:21:26 -0500
Subject: [PATCH 098/479] build: test against Node.js 10.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index a83b962abe2..edde93bcf0f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,6 +14,8 @@ matrix:
   include:
     - node_js: "9"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "10"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From 0083372bed2df35abf56ac882bd42f01bd6cff39 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 26 Feb 2018 23:18:07 -0500
Subject: [PATCH 099/479] deps: proxy-addr@~2.0.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 756198b4398..21e9d7e7276 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,8 @@ unreleased
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
     - Fix encoding `%` as last character
+  * deps: proxy-addr@~2.0.3
+    - deps: ipaddr.js@1.6.0
   * deps: send@0.16.2
     - Fix incorrect end tag in default error & redirects
     - deps: depd@~1.1.2
diff --git a/package.json b/package.json
index b86eb6f1a6f..0c4277e33c8 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.2",
+    "proxy-addr": "~2.0.3",
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",

From e69a29d9c2a425ad10be08833c099a1cfede010a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 Feb 2018 19:55:34 -0500
Subject: [PATCH 100/479] deps: type-is@~1.6.16

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 21e9d7e7276..9048f7caa49 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,8 @@ unreleased
     - deps: encodeurl@~1.0.2
     - deps: send@0.16.2
   * deps: statuses@~1.4.0
+  * deps: type-is@~1.6.16
+    - deps: mime-types@~2.1.18
 
 4.16.2 / 2017-10-09
 ===================
diff --git a/package.json b/package.json
index 0c4277e33c8..f8067410db6 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.0",
     "statuses": "~1.4.0",
-    "type-is": "~1.6.15",
+    "type-is": "~1.6.16",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"
   },

From 0e88dceac2b86fbc066cd0f042d093e838604d0d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 Feb 2018 23:44:00 -0500
Subject: [PATCH 101/479] deps: accepts@~1.3.5

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9048f7caa49..b2d3af1cbdd 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: accepts@~1.3.5
+    - deps: mime-types@~2.1.18
   * deps: depd@~1.1.2
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
diff --git a/package.json b/package.json
index f8067410db6..f6d45ffbab3 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.3.4",
+    "accepts": "~1.3.5",
     "array-flatten": "1.1.1",
     "body-parser": "1.18.2",
     "content-disposition": "0.5.2",

From d3bdc3b66399424f8b315d0808b5fbb3834144c2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Mar 2018 11:17:26 -0400
Subject: [PATCH 102/479] build: marked@0.3.17

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f6d45ffbab3..5a377805510 100644
--- a/package.json
+++ b/package.json
@@ -67,7 +67,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.3.12",
+    "marked": "0.3.17",
     "method-override": "2.3.10",
     "mocha": "3.5.3",
     "morgan": "1.9.0",

From 76bf96e9ce3369d2f9329adefb9ac75407f93493 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Mar 2018 11:20:19 -0400
Subject: [PATCH 103/479] deps: finalhandler@1.1.1

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b2d3af1cbdd..956fc8571fe 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,10 @@ unreleased
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
     - Fix encoding `%` as last character
+  * deps: finalhandler@1.1.1
+    - Fix 404 output for bad / missing pathnames
+    - deps: encodeurl@~1.0.2
+    - deps: statuses@~1.4.0
   * deps: proxy-addr@~2.0.3
     - deps: ipaddr.js@1.6.0
   * deps: send@0.16.2
diff --git a/package.json b/package.json
index 5a377805510..a203b81b236 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "1.1.0",
+    "finalhandler": "1.1.1",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 3ed5090ca91f6a387e66370d57ead94d886275e1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Mar 2018 13:38:44 -0400
Subject: [PATCH 104/479] 4.16.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 956fc8571fe..e02fcd5bf9e 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.3 / 2018-03-12
+===================
 
   * deps: accepts@~1.3.5
     - deps: mime-types@~2.1.18
diff --git a/package.json b/package.json
index a203b81b236..7aa0f95b3ac 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.2",
+  "version": "4.16.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 02c753583eddabae2691b09a7babd747d449ca5f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Jun 2018 23:50:03 -0400
Subject: [PATCH 105/479] build: Node.js@4.9

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index edde93bcf0f..af0c01ad535 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,7 +5,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.8"
+  - "4.9"
   - "5.12"
   - "6.12"
   - "7.10"
diff --git a/appveyor.yml b/appveyor.yml
index ab65453be3b..5deb61cea33 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -5,7 +5,7 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
-    - nodejs_version: "4.8"
+    - nodejs_version: "4.9"
     - nodejs_version: "5.12"
     - nodejs_version: "6.12"
     - nodejs_version: "7.10"

From 3d8ca8ad4aa0ad03ce2e4b27f6773d47e4fea201 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Jun 2018 00:04:28 -0400
Subject: [PATCH 106/479] build: Node.js@6.14

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index af0c01ad535..5c85496d1da 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.12"
+  - "6.14"
   - "7.10"
   - "8.9"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index 5deb61cea33..5c8161fa75a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.9"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.12"
+    - nodejs_version: "6.14"
     - nodejs_version: "7.10"
     - nodejs_version: "8.9"
 cache:

From ac89f6f121cbd17c957e8e493615c33e7f0f2687 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Jun 2018 00:12:07 -0400
Subject: [PATCH 107/479] build: Node.js@8.11

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 5c85496d1da..acfb87c2065 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.14"
   - "7.10"
-  - "8.9"
+  - "8.11"
 matrix:
   include:
     - node_js: "9"
diff --git a/appveyor.yml b/appveyor.yml
index 5c8161fa75a..e5e653abe67 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,7 +9,7 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.14"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.9"
+    - nodejs_version: "8.11"
 cache:
   - node_modules
 install:

From f95dbc28fdb483dbd45b436386cf0db77322eb43 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 31 Jul 2018 17:09:27 -0400
Subject: [PATCH 108/479] build: should@13.2.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 7aa0f95b3ac..cf38858b5c1 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
     "morgan": "1.9.0",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "13.2.1",
+    "should": "13.2.3",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From c39d7d933968b3cc03c6bf473920b8d5f24f7f43 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 13 Sep 2018 12:23:38 -0400
Subject: [PATCH 109/479] build: Node.js@8.12

---
 .travis.yml  | 2 +-
 appveyor.yml | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index acfb87c2065..239e8071d12 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.14"
   - "7.10"
-  - "8.11"
+  - "8.12"
 matrix:
   include:
     - node_js: "9"
diff --git a/appveyor.yml b/appveyor.yml
index e5e653abe67..6e77e88bcdd 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,11 +9,13 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.14"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.11"
+    - nodejs_version: "8.12"
 cache:
   - node_modules
 install:
-  - ps: Install-Product node $env:nodejs_version
+  - ps: >-
+      try { Install-Product node $env:nodejs_version -ErrorAction Stop }
+      catch { Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version) }
   - npm config set shrinkwrap false
   - npm rm --save-dev connect-redis
   - if exist node_modules npm prune

From d5b33cfad8efedc42ec36cab2ced75c2cfd99dce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 13 Sep 2018 12:26:36 -0400
Subject: [PATCH 110/479] build: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index cf38858b5c1..0b87ae7657d 100644
--- a/package.json
+++ b/package.json
@@ -62,16 +62,16 @@
     "after": "0.8.2",
     "cookie-parser": "~1.4.3",
     "cookie-session": "1.3.2",
-    "ejs": "2.5.7",
+    "ejs": "2.6.1",
     "eslint": "2.13.1",
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.3.17",
-    "method-override": "2.3.10",
+    "marked": "0.5.0",
+    "method-override": "3.0.0",
     "mocha": "3.5.3",
-    "morgan": "1.9.0",
-    "multiparty": "4.1.3",
+    "morgan": "1.9.1",
+    "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
     "supertest": "1.2.0",

From ede24da9645ed771ddeb9cf327d042d35a31d42d Mon Sep 17 00:00:00 2001
From: Logan Ripplinger <logan.ripplinger@gmail.com>
Date: Tue, 14 Aug 2018 18:41:14 -0700
Subject: [PATCH 111/479] examples: fix typo in multi-router example

closes #3718
---
 examples/multi-router/index.js  | 2 +-
 test/acceptance/multi-router.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/multi-router/index.js b/examples/multi-router/index.js
index ff31e514a56..78bae9d6e36 100644
--- a/examples/multi-router/index.js
+++ b/examples/multi-router/index.js
@@ -6,7 +6,7 @@ app.use('/api/v1', require('./controllers/api_v1'));
 app.use('/api/v2', require('./controllers/api_v2'));
 
 app.get('/', function(req, res) {
-  res.send('Hello form root route.');
+  res.send('Hello from root route.')
 });
 
 /* istanbul ignore next */
diff --git a/test/acceptance/multi-router.js b/test/acceptance/multi-router.js
index 9590ee94d41..4362a8300be 100644
--- a/test/acceptance/multi-router.js
+++ b/test/acceptance/multi-router.js
@@ -6,7 +6,7 @@ describe('multi-router', function(){
     it('should respond with root handler', function(done){
       request(app)
       .get('/')
-      .expect(200, 'Hello form root route.', done)
+      .expect(200, 'Hello from root route.', done)
     })
   })
 

From f3fa758af9664526ee18c58764590e48f559e6ae Mon Sep 17 00:00:00 2001
From: Andreas Kohn <andreas.kohn@gmail.com>
Date: Sat, 26 May 2018 21:58:15 +0200
Subject: [PATCH 112/479] Fix JSDoc for Router constructor

fixes #3598
fixes #3599
fixes #3698
---
 History.md          | 5 +++++
 lib/router/index.js | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e02fcd5bf9e..9295b05feb6 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix JSDoc for `Router` constructor
+
 4.16.3 / 2018-03-12
 ===================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 60727ed6d64..69e6d3800af 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -35,7 +35,7 @@ var toString = Object.prototype.toString;
 /**
  * Initialize a new `Router` with the given `options`.
  *
- * @param {Object} options
+ * @param {Object} [options]
  * @return {Router} which is an callable function
  * @public
  */

From 431f65305eb78eba337356ec7637e4ee13d84195 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Linus=20Unneb=C3=A4ck?= <linus@folkdatorn.se>
Date: Wed, 27 Jun 2018 10:40:56 +0200
Subject: [PATCH 113/479] lint: move removed middlewares list to a variable

closes #3558
closes #3677
closes #3678
---
 lib/express.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/express.js b/lib/express.js
index 485a8fc08de..594007b5b43 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -84,7 +84,7 @@ exports.urlencoded = bodyParser.urlencoded
  * Replace removed middleware with an appropriate error message.
  */
 
-;[
+var removedMiddlewares = [
   'bodyParser',
   'compress',
   'cookieSession',
@@ -101,8 +101,10 @@ exports.urlencoded = bodyParser.urlencoded
   'directory',
   'limit',
   'multipart',
-  'staticCache',
-].forEach(function (name) {
+  'staticCache'
+]
+
+removedMiddlewares.forEach(function (name) {
   Object.defineProperty(exports, name, {
     get: function () {
       throw new Error('Most middleware (like ' + name + ') is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');

From b4eb1f59d39d801d7365c86b04500f16faeb0b1c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 18 Sep 2018 21:56:31 -0400
Subject: [PATCH 114/479] deps: qs@6.5.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9295b05feb6..eda6c4d76f3 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix JSDoc for `Router` constructor
+  * deps: qs@6.5.2
 
 4.16.3 / 2018-03-12
 ===================
diff --git a/package.json b/package.json
index 0b87ae7657d..1e10d5534ec 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.3",
-    "qs": "6.5.1",
+    "qs": "6.5.2",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
     "send": "0.16.2",

From b8fb6a7fb1af155b1259d25418dc807112e02138 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20Bu=CC=88nemann?= <buenemann@louis.info>
Date: Tue, 15 May 2018 23:45:17 +0200
Subject: [PATCH 115/479] deps: body-parser@1.18.3

closes #3655
closes #3706
---
 History.md   | 9 +++++++++
 package.json | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index eda6c4d76f3..bc77d81ed9e 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,15 @@ unreleased
 ==========
 
   * Fix JSDoc for `Router` constructor
+  * deps: body-parser@1.18.3
+    - Fix deprecation warnings on Node.js 10+
+    - Fix stack trace for strict json parse error
+    - deps: depd@~1.1.2
+    - deps: http-errors@~1.6.3
+    - deps: iconv-lite@0.4.23
+    - deps: qs@6.5.2
+    - deps: raw-body@2.3.3
+    - deps: type-is@~1.6.16
   * deps: qs@6.5.2
 
 4.16.3 / 2018-03-12
diff --git a/package.json b/package.json
index 1e10d5534ec..3b6eac1187b 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
   "dependencies": {
     "accepts": "~1.3.5",
     "array-flatten": "1.1.1",
-    "body-parser": "1.18.2",
+    "body-parser": "1.18.3",
     "content-disposition": "0.5.2",
     "content-type": "~1.0.4",
     "cookie": "0.3.1",

From 4480fb997e9132a8b1e8b23d1a2766d27a918909 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Sep 2018 12:40:40 -0400
Subject: [PATCH 116/479] deps: proxy-addr@~2.0.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index bc77d81ed9e..d7b08c54484 100644
--- a/History.md
+++ b/History.md
@@ -11,6 +11,8 @@ unreleased
     - deps: qs@6.5.2
     - deps: raw-body@2.3.3
     - deps: type-is@~1.6.16
+  * deps: proxy-addr@~2.0.4
+    - deps: ipaddr.js@1.8.0
   * deps: qs@6.5.2
 
 4.16.3 / 2018-03-12
diff --git a/package.json b/package.json
index 3b6eac1187b..a0da2a7320a 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.3",
+    "proxy-addr": "~2.0.4",
     "qs": "6.5.2",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",

From 5de1a08ebff4c33d0c452510217193905f34cbe9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Sep 2018 14:06:22 -0400
Subject: [PATCH 117/479] build: supertest@2.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a0da2a7320a..8bc9069a8fc 100644
--- a/package.json
+++ b/package.json
@@ -74,7 +74,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "1.2.0",
+    "supertest": "2.0.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"
   },

From 5e9de5dcb6f1ff396038ded11951aa53c62a07a4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Sep 2018 14:47:48 -0400
Subject: [PATCH 118/479] deps: safe-buffer@5.1.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d7b08c54484..ef1733fc26e 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,7 @@ unreleased
   * deps: proxy-addr@~2.0.4
     - deps: ipaddr.js@1.8.0
   * deps: qs@6.5.2
+  * deps: safe-buffer@5.1.2
 
 4.16.3 / 2018-03-12
 ===================
diff --git a/package.json b/package.json
index 8bc9069a8fc..45faac1c6ba 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "proxy-addr": "~2.0.4",
     "qs": "6.5.2",
     "range-parser": "~1.2.0",
-    "safe-buffer": "5.1.1",
+    "safe-buffer": "5.1.2",
     "send": "0.16.2",
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.0",

From 3d10279826f59bf68e28995ce423f7bc4d2f11cf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Sep 2018 23:25:16 -0400
Subject: [PATCH 119/479] Fix issue where "Request aborted" may be logged in
 res.sendfile

---
 History.md           |  1 +
 lib/response.js      |  2 +-
 test/res.sendFile.js | 26 +++++++++++++++++---------
 3 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/History.md b/History.md
index ef1733fc26e..2d902e94d61 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix issue where `"Request aborted"` may be logged in `res.sendfile`
   * Fix JSDoc for `Router` constructor
   * deps: body-parser@1.18.3
     - Fix deprecation warnings on Node.js 10+
diff --git a/lib/response.js b/lib/response.js
index 9c1796d37b3..2e445ac02c5 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -500,7 +500,7 @@ res.sendfile = function (path, options, callback) {
     if (err && err.code === 'EISDIR') return next();
 
     // next() all but write errors
-    if (err && err.code !== 'ECONNABORT' && err.syscall !== 'write') {
+    if (err && err.code !== 'ECONNABORTED' && err.syscall !== 'write') {
       next(err);
     }
   });
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index ccec3f40cfe..46cf98bd3b9 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -96,25 +96,29 @@ describe('res', function(){
     })
 
     it('should not error if the client aborts', function (done) {
-      var cb = after(1, done);
       var app = express();
+      var cb = after(2, done)
+      var error = null
 
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'));
           server.close(cb)
-        });
+          setTimeout(function () {
+            cb(error)
+          }, 10)
+        })
         test.abort();
       });
 
       app.use(function (err, req, res, next) {
-        err.code.should.be.empty()
-        cb();
+        error = err
+        next(err)
       });
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.expect(200, cb);
+      test.end()
     })
 
     describe('with "cacheControl" option', function () {
@@ -628,25 +632,29 @@ describe('res', function(){
     });
 
     it('should not error if the client aborts', function (done) {
-      var cb = after(1, done);
       var app = express();
+      var cb = after(2, done)
+      var error = null
 
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendfile(path.resolve(fixtures, 'name.txt'));
           server.close(cb)
+          setTimeout(function () {
+            cb(error)
+          }, 10)
         });
         test.abort();
       });
 
       app.use(function (err, req, res, next) {
-        err.code.should.be.empty()
-        cb();
+        error = err
+        next(err)
       });
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.expect(200, cb);
+      test.end()
     })
 
     describe('with an absolute path', function(){

From 09d5654488f707db2ee05e0358bb74caa44fed91 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 23:01:22 -0400
Subject: [PATCH 120/479] build: restructure CI build steps

---
 .travis.yml  | 32 ++++++++++++++++++++++----------
 appveyor.yml | 29 +++++++++++++++++++++++------
 2 files changed, 45 insertions(+), 16 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 239e8071d12..cd312691a22 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -24,16 +24,28 @@ cache:
   directories:
     - node_modules
 before_install:
-  # Skip updating shrinkwrap / lock
-  - "npm config set shrinkwrap false"
-
+  # Configure npm
+  - |
+    # Skip updating shrinkwrap / lock
+    npm config set shrinkwrap false
   # Remove all non-test dependencies
-  - "npm rm --save-dev connect-redis"
-
+  - |
+    # Remove example dependencies
+    npm rm --silent --save-dev connect-redis
   # Update Node.js modules
-  - "test ! -d node_modules || npm prune"
-  - "test ! -d node_modules || npm rebuild"
+  - |
+    # Prune and rebuild node_modules
+    if [[ -d node_modules ]]; then
+      npm prune
+      npm rebuild
+    fi
 script:
-  - "npm run test-ci"
-  - "npm run lint"
-after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"
+  # Run test script
+  - npm run test-ci
+  # Run linting
+  - npm run lint
+after_script:
+  - |
+    # Upload coverage to coveralls
+    npm install --save-dev coveralls@2.10.0
+    coveralls < ./coverage/lcov.info
diff --git a/appveyor.yml b/appveyor.yml
index 6e77e88bcdd..fd5dcea0a6d 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,18 +13,35 @@ environment:
 cache:
   - node_modules
 install:
+  # Install Node.js
   - ps: >-
       try { Install-Product node $env:nodejs_version -ErrorAction Stop }
       catch { Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version) }
-  - npm config set shrinkwrap false
-  - npm rm --save-dev connect-redis
-  - if exist node_modules npm prune
-  - if exist node_modules npm rebuild
+  # Configure npm
+  - ps: |
+      # Skip updating shrinkwrap / lock
+      npm config set shrinkwrap false
+  # Remove all non-test dependencies
+  - ps: |
+      # Remove example dependencies
+      npm rm --silent --save-dev connect-redis
+  # Update Node.js modules
+  - ps: |
+      # Prune & rebuild node_modules
+      if (Test-Path -Path node_modules) {
+        npm prune
+        npm rebuild
+      }
+  # Install Node.js modules
   - npm install
 build: off
 test_script:
-  - node --version
-  - npm --version
+  # Output version data
+  - ps: |
+      node --version
+      npm --version
+  # Run test script
   - npm run test-ci
+  # Run linting
   - npm run lint
 version: "{build}"

From f07f368fba5d91a5a80bff80c360bd5d66ed8116 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 23:16:17 -0400
Subject: [PATCH 121/479] build: mocha@5.2.0

---
 .travis.yml     |  7 +++++++
 appveyor.yml    |  7 +++++++
 package.json    | 10 +++++-----
 test/mocha.opts |  1 -
 4 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index cd312691a22..a4f644190a5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -32,6 +32,13 @@ before_install:
   - |
     # Remove example dependencies
     npm rm --silent --save-dev connect-redis
+  # Setup Node.js version-specific dependencies
+  - |
+    # mocha for testing
+    # - use 3.x for Node.js < 6
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
+      npm install --silent --save-dev mocha@3.5.3
+    fi
   # Update Node.js modules
   - |
     # Prune and rebuild node_modules
diff --git a/appveyor.yml b/appveyor.yml
index fd5dcea0a6d..bb954116f16 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -25,6 +25,13 @@ install:
   - ps: |
       # Remove example dependencies
       npm rm --silent --save-dev connect-redis
+  # Setup Node.js version-specific dependencies
+  - ps: |
+      # mocha for testing
+      # - use 3.x for Node.js < 6
+      if ($env:nodejs_version.split(".")[0] -lt 6) {
+        npm install --silent --save-dev mocha@3.5.3
+      }
   # Update Node.js modules
   - ps: |
       # Prune & rebuild node_modules
diff --git a/package.json b/package.json
index 45faac1c6ba..bbd79fbf887 100644
--- a/package.json
+++ b/package.json
@@ -69,7 +69,7 @@
     "istanbul": "0.4.5",
     "marked": "0.5.0",
     "method-override": "3.0.0",
-    "mocha": "3.5.3",
+    "mocha": "5.2.0",
     "morgan": "1.9.1",
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
@@ -90,9 +90,9 @@
   ],
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks --no-exit test/ test/acceptance/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks --no-exit test/ test/acceptance/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks --no-exit test/ test/acceptance/",
-    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks --no-exit test/ test/acceptance/"
+    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"
   }
 }
diff --git a/test/mocha.opts b/test/mocha.opts
index 24d45f5902f..1e065ec52d9 100644
--- a/test/mocha.opts
+++ b/test/mocha.opts
@@ -1,3 +1,2 @@
 --require should
 --slow 20
---growl

From 451ee5d9c17b8abd6859b939a5edfa083a61127d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 24 Sep 2018 23:40:21 -0400
Subject: [PATCH 122/479] build: supertest@3.3.0

---
 .travis.yml          |  6 ++++++
 appveyor.yml         |  6 ++++++
 package.json         |  2 +-
 test/app.router.js   |  8 ++------
 test/res.download.js | 13 ++++++++++++-
 test/res.redirect.js | 15 +++++++++++++--
 test/res.send.js     | 24 ++++++++++++++++++++++--
 test/res.sendFile.js | 19 +++++++++++++++++--
 8 files changed, 79 insertions(+), 14 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index a4f644190a5..ebeed7008dd 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -39,6 +39,12 @@ before_install:
     if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
       npm install --silent --save-dev mocha@3.5.3
     fi
+  - |
+    # supertest for http calls
+    # - use 2.0.0 for Node.js < 4
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
+      npm install --silent --save-dev supertest@2.0.0
+    fi
   # Update Node.js modules
   - |
     # Prune and rebuild node_modules
diff --git a/appveyor.yml b/appveyor.yml
index bb954116f16..fc3582e4a5a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -32,6 +32,12 @@ install:
       if ($env:nodejs_version.split(".")[0] -lt 6) {
         npm install --silent --save-dev mocha@3.5.3
       }
+  - ps: |
+      # supertest for http calls
+      # - use 2.0.0 for Node.js < 4
+      if ($env:nodejs_version.split(".")[0] -lt 4) {
+        npm install --silent --save-dev supertest@2.0.0
+      }
   # Update Node.js modules
   - ps: |
       # Prune & rebuild node_modules
diff --git a/package.json b/package.json
index bbd79fbf887..2ffd015a6a0 100644
--- a/package.json
+++ b/package.json
@@ -74,7 +74,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "2.0.0",
+    "supertest": "3.3.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"
   },
diff --git a/test/app.router.js b/test/app.router.js
index c4bfc9b952a..a6c8cef202a 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -41,16 +41,12 @@ describe('app.router', function(){
         var app = express();
 
         app[method]('/foo', function(req, res){
-          if (method === 'head') {
-            res.end();
-          } else {
-            res.end(method);
-          }
+          res.send(method)
         });
 
         request(app)
         [method]('/foo')
-        .expect(method === 'head' ? '' : method, done)
+        .expect(200, done)
       })
 
       it('should reject numbers for app.' + method, function(){
diff --git a/test/res.download.js b/test/res.download.js
index 30215bf6764..084b3c7164d 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,6 +1,7 @@
 
 var after = require('after');
 var assert = require('assert');
+var Buffer = require('safe-buffer').Buffer
 var express = require('..');
 var request = require('supertest');
 
@@ -104,7 +105,7 @@ describe('res', function(){
       .expect(200)
       .expect('Content-Disposition', 'attachment; filename="document"')
       .expect('Cache-Control', 'public, max-age=14400')
-      .expect('tobi')
+      .expect(shouldHaveBody(Buffer.from('tobi')))
       .end(done)
     })
 
@@ -185,6 +186,16 @@ describe('res', function(){
   })
 })
 
+function shouldHaveBody (buf) {
+  return function (res) {
+    var body = !Buffer.isBuffer(res.body)
+      ? Buffer.from(res.text)
+      : res.body
+    assert.ok(body, 'response has body')
+    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
+  }
+}
+
 function shouldNotHaveHeader(header) {
   return function (res) {
     assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 755bb1c1c6c..c07df5dd2c4 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('..');
 var request = require('supertest');
 var utils = require('./support/utils');
@@ -85,8 +86,10 @@ describe('res', function(){
 
       request(app)
       .head('/')
+      .expect(302)
       .expect('Location', 'http://google.com')
-      .expect(302, '', done)
+      .expect(shouldNotHaveBody())
+      .end(done)
     })
   })
 
@@ -197,10 +200,18 @@ describe('res', function(){
       request(app)
       .get('/')
       .set('Accept', 'application/octet-stream')
+      .expect(302)
       .expect('location', 'http://google.com')
       .expect('content-length', '0')
       .expect(utils.shouldNotHaveHeader('Content-Type'))
-      .expect(302, '', done)
+      .expect(shouldNotHaveBody())
+      .end(done)
     })
   })
 })
+
+function shouldNotHaveBody () {
+  return function (res) {
+    assert.ok(res.text === '' || res.text === undefined)
+  }
+}
diff --git a/test/res.send.js b/test/res.send.js
index 13658fe6b01..b836b5e4dcb 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -188,8 +188,10 @@ describe('res', function(){
 
       request(app)
       .get('/')
+      .expect(200)
       .expect('Content-Type', 'application/octet-stream')
-      .expect(200, 'hello', done);
+      .expect(shouldHaveBody(Buffer.from('hello')))
+      .end(done)
     })
 
     it('should set ETag', function (done) {
@@ -257,7 +259,9 @@ describe('res', function(){
 
       request(app)
       .head('/')
-      .expect('', done);
+      .expect(200)
+      .expect(shouldNotHaveBody())
+      .end(done)
     })
   })
 
@@ -573,3 +577,19 @@ describe('res', function(){
     })
   })
 })
+
+function shouldHaveBody (buf) {
+  return function (res) {
+    var body = !Buffer.isBuffer(res.body)
+      ? Buffer.from(res.text)
+      : res.body
+    assert.ok(body, 'response has body')
+    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
+  }
+}
+
+function shouldNotHaveBody () {
+  return function (res) {
+    assert.ok(res.text === '' || res.text === undefined)
+  }
+}
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 46cf98bd3b9..d7585b7704c 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -1,5 +1,6 @@
 
 var after = require('after');
+var Buffer = require('safe-buffer').Buffer
 var express = require('../')
   , request = require('supertest')
   , assert = require('assert');
@@ -155,7 +156,9 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(200, 'tobi', done);
+        .expect(200)
+        .expect(shouldHaveBody(Buffer.from('tobi')))
+        .end(done)
       });
     });
 
@@ -548,7 +551,9 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect(200, 'tobi', done);
+      .expect(200)
+      .expect(shouldHaveBody(Buffer.from('tobi')))
+      .end(done)
     })
 
     it('should accept headers option', function(done){
@@ -801,3 +806,13 @@ function createApp(path, options, fn) {
 
   return app;
 }
+
+function shouldHaveBody (buf) {
+  return function (res) {
+    var body = !Buffer.isBuffer(res.body)
+      ? Buffer.from(res.text)
+      : res.body
+    assert.ok(body, 'response has body')
+    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
+  }
+}

From 62a59b6ace6c1cb34f9adf2d433ac57d3c826ce4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Sep 2018 18:09:27 -0400
Subject: [PATCH 123/479] build: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 2ffd015a6a0..6118573572f 100644
--- a/package.json
+++ b/package.json
@@ -60,6 +60,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
+    "connect-redis": "3.4.0",
     "cookie-parser": "~1.4.3",
     "cookie-session": "1.3.2",
     "ejs": "2.6.1",
@@ -67,7 +68,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.5.0",
+    "marked": "0.5.1",
     "method-override": "3.0.0",
     "mocha": "5.2.0",
     "morgan": "1.9.1",
@@ -75,7 +76,6 @@
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
     "supertest": "3.3.0",
-    "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"
   },
   "engines": {

From dc538f6e810bd462c98ee7e6aae24c64d4b1da93 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Oct 2018 23:50:45 -0400
Subject: [PATCH 124/479] 4.16.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 2d902e94d61..2f6eab101ae 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.4 / 2018-10-10
+===================
 
   * Fix issue where `"Request aborted"` may be logged in `res.sendfile`
   * Fix JSDoc for `Router` constructor
diff --git a/package.json b/package.json
index 6118573572f..74196ad68e2 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.3",
+  "version": "4.16.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From d0421ac7e1f897e15a2f7a9328e9bfd938b95a9f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 26 Oct 2018 23:34:00 -0400
Subject: [PATCH 125/479] tests: use supertest to perform assertions

---
 test/app.router.js | 24 +++++++++---------------
 test/res.cookie.js |  7 ++-----
 test/res.locals.js | 10 ++++------
 3 files changed, 15 insertions(+), 26 deletions(-)

diff --git a/test/app.router.js b/test/app.router.js
index a6c8cef202a..d716ea4b046 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -152,15 +152,12 @@ describe('app.router', function(){
 
     app.use(function(req, res, next){
       calls.push('after');
-      res.end();
+      res.json(calls)
     });
 
     request(app)
     .get('/')
-    .end(function(res){
-      calls.should.eql(['before', 'GET /', 'after'])
-      done();
-    })
+    .expect(200, ['before', 'GET /', 'after'], done)
   })
 
   describe('when given a regexp', function(){
@@ -891,15 +888,12 @@ describe('app.router', function(){
 
       app.get('/foo', function(req, res, next){
         calls.push('/foo 2');
-        res.end('done');
+        res.json(calls)
       });
 
       request(app)
       .get('/foo')
-      .expect('done', function(){
-        calls.should.eql(['/foo/:bar?', '/foo', '/foo 2']);
-        done();
-      })
+      .expect(200, ['/foo/:bar?', '/foo', '/foo 2'], done)
     })
   })
 
@@ -982,15 +976,15 @@ describe('app.router', function(){
       });
 
       app.use(function(err, req, res, next){
-        res.end(err.message);
+        res.json({
+          calls: calls,
+          error: err.message
+        })
       })
 
       request(app)
       .get('/foo')
-      .expect('fail', function(){
-        calls.should.eql(['/foo/:bar?', '/foo']);
-        done();
-      })
+      .expect(200, { calls: ['/foo/:bar?', '/foo'], error: 'fail' }, done)
     })
 
     it('should call handler in same route, if exists', function(done){
diff --git a/test/res.cookie.js b/test/res.cookie.js
index 4eeaaf094ad..271a0969e62 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -108,15 +108,12 @@ describe('res', function(){
 
         app.use(function(req, res){
           res.cookie('name', 'tobi', options)
-          res.end();
+          res.json(options)
         });
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          options.should.eql(optionsCopy);
-          done();
-        })
+        .expect(200, optionsCopy, done)
       })
     })
 
diff --git a/test/res.locals.js b/test/res.locals.js
index 3c83e66c54f..a1c819667a3 100644
--- a/test/res.locals.js
+++ b/test/res.locals.js
@@ -8,13 +8,12 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        Object.keys(res.locals).should.eql([]);
-        res.end();
+        res.json(res.locals)
       });
 
       request(app)
       .get('/')
-      .expect(200, done);
+      .expect(200, {}, done)
     })
   })
 
@@ -30,12 +29,11 @@ describe('res', function(){
     });
 
     app.use(function(req, res){
-      res.locals.foo.should.equal('bar');
-      res.end();
+      res.json(res.locals)
     });
 
     request(app)
     .get('/')
-    .expect(200, done);
+    .expect(200, { foo: 'bar' }, done)
   })
 })

From a6b119d27a2f1703d51d1938e6fe98b0ee2d5651 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Oct 2018 00:05:00 -0400
Subject: [PATCH 126/479] build: coveralls@2.12.0

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ebeed7008dd..a36ad43c97b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -60,5 +60,5 @@ script:
 after_script:
   - |
     # Upload coverage to coveralls
-    npm install --save-dev coveralls@2.10.0
+    npm install --save-dev coveralls@2.12.0
     coveralls < ./coverage/lcov.info

From 6295b4592014515e137c17e854f83d1c0274198a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Oct 2018 00:50:58 -0400
Subject: [PATCH 127/479] build: test against Node.js 11.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index a36ad43c97b..a49b22edcf3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,6 +16,8 @@ matrix:
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "10"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "11"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From 003459b795b3ab2ae97c2131585b0560c1d35716 Mon Sep 17 00:00:00 2001
From: Nacim Goura <nacim.goura@gmail.com>
Date: Tue, 10 Apr 2018 11:33:43 +0200
Subject: [PATCH 128/479] build: support Node.js 9.x

closes #3617
---
 .travis.yml  | 3 +--
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index a49b22edcf3..aad455e48ba 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,10 +10,9 @@ node_js:
   - "6.14"
   - "7.10"
   - "8.12"
+  - "9.11"
 matrix:
   include:
-    - node_js: "9"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "10"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "11"
diff --git a/appveyor.yml b/appveyor.yml
index fc3582e4a5a..0a911723cf2 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -10,6 +10,7 @@ environment:
     - nodejs_version: "6.14"
     - nodejs_version: "7.10"
     - nodejs_version: "8.12"
+    - nodejs_version: "9.11"
 cache:
   - node_modules
 install:

From 44e539e1dcdc010638812fc96f541da3f02d35de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20Bu=CC=88nemann?= <buenemann@louis.info>
Date: Wed, 16 May 2018 18:27:06 +0200
Subject: [PATCH 129/479] build: support Node.js 10.x

closes #3617
---
 .travis.yml  | 3 +--
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index aad455e48ba..c802e4fd3a7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,10 +11,9 @@ node_js:
   - "7.10"
   - "8.12"
   - "9.11"
+  - "10.12"
 matrix:
   include:
-    - node_js: "10"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "11"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
diff --git a/appveyor.yml b/appveyor.yml
index 0a911723cf2..4006a5e51d9 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,6 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.12"
     - nodejs_version: "9.11"
+    - nodejs_version: "10.12"
 cache:
   - node_modules
 install:

From 6bcdfef6ad148672872e4f5930a01a5a45dd9df0 Mon Sep 17 00:00:00 2001
From: void <thevoidf@gmail.com>
Date: Sun, 4 Mar 2018 04:56:32 +0400
Subject: [PATCH 130/479] Improve error message for non-strings to res.sendFile

closes #3582
---
 History.md           | 5 +++++
 lib/response.js      | 4 ++++
 test/res.sendFile.js | 8 ++++++++
 3 files changed, 17 insertions(+)

diff --git a/History.md b/History.md
index 2f6eab101ae..6a0699421ad 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Improve error message for non-strings to `res.sendFile`
+
 4.16.4 / 2018-10-10
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index 2e445ac02c5..11adeb614a9 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -411,6 +411,10 @@ res.sendFile = function sendFile(path, options, callback) {
     throw new TypeError('path argument is required to res.sendFile');
   }
 
+  if (typeof path !== 'string') {
+    throw new TypeError('path must be a string to res.sendFile')
+  }
+
   // support function as second arg
   if (typeof options === 'function') {
     done = options;
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index d7585b7704c..5f494f1e0bc 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -20,6 +20,14 @@ describe('res', function(){
       .expect(500, /path.*required/, done);
     });
 
+    it('should error for non-string path', function (done) {
+      var app = createApp(42)
+
+      request(app)
+      .get('/')
+      .expect(500, /TypeError: path must be a string to res.sendFile/, done)
+    })
+
     it('should transfer a file', function (done) {
       var app = createApp(path.resolve(fixtures, 'name.txt'));
 

From 8da51108e7bb501344c537d3f1f846a7477ae329 Mon Sep 17 00:00:00 2001
From: Joshua Caron <joshua@joshuacaron.ca>
Date: Thu, 12 Nov 2015 13:33:06 -0500
Subject: [PATCH 131/479] Improve error message for null/undefined to
 res.status

closes #2795
closes #2797
closes #3111
---
 History.md         |  1 +
 lib/response.js    |  4 ++++
 test/res.status.js | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+)

diff --git a/History.md b/History.md
index 6a0699421ad..35147d390d3 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Improve error message for non-strings to `res.sendFile`
+  * Improve error message for `null`/`undefined` to `res.status`
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/lib/response.js b/lib/response.js
index 11adeb614a9..60f8979e859 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -64,6 +64,10 @@ var charsetRegExp = /;\s*charset\s*=/;
  */
 
 res.status = function status(code) {
+  if (code === undefined || code === null) {
+    throw new TypeError('code argument is required to res.status')
+  }
+
   this.statusCode = code;
   return this;
 };
diff --git a/test/res.status.js b/test/res.status.js
index 8c173a645c5..3f928ec0b0b 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -16,5 +16,37 @@ describe('res', function(){
       .expect('Created')
       .expect(201, done);
     })
+
+    describe('when code is undefined', function () {
+      it('should throw a TypeError', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(undefined).send('OK')
+        })
+
+        request(app)
+        .get('/')
+        .expect(500)
+        .expect(/TypeError: code argument is required to res.status/)
+        .end(done)
+      })
+    })
+
+    describe('when code is null', function () {
+      it('should throw a TypeError', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(null).send('OK')
+        })
+
+        request(app)
+        .get('/')
+        .expect(500)
+        .expect(/TypeError: code argument is required to res.status/)
+        .end(done)
+      })
+    })
   })
 })

From b93ffd4bdc09c3af925eed80c28bd37f63bb3cfc Mon Sep 17 00:00:00 2001
From: Horatiu Eugen Vlad <horatiu@vlad.eu>
Date: Sun, 3 Dec 2017 19:52:46 +0100
Subject: [PATCH 132/479] Support multiple hosts in X-Forwarded-Host

fixes #3494
closes #3495
---
 History.md           |  1 +
 lib/request.js       |  4 ++++
 test/req.hostname.js | 50 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+)

diff --git a/History.md b/History.md
index 35147d390d3..c29a4490bd4 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
+  * Support multiple hosts in `X-Forwarded-Host`
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/lib/request.js b/lib/request.js
index 8bb86a9acc4..a9400ef99de 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -430,6 +430,10 @@ defineGetter(req, 'hostname', function hostname(){
 
   if (!host || !trust(this.connection.remoteAddress, 0)) {
     host = this.get('Host');
+  } else if (host.indexOf(',') !== -1) {
+    // Note: X-Forwarded-Host is normally only ever a
+    //       single value, but this is to be safe.
+    host = host.substring(0, host.indexOf(',')).trimRight()
   }
 
   if (!host) return;
diff --git a/test/req.hostname.js b/test/req.hostname.js
index 816cd597990..09bfb899898 100644
--- a/test/req.hostname.js
+++ b/test/req.hostname.js
@@ -116,6 +116,56 @@ describe('req', function(){
         .set('Host', 'example.com')
         .expect('example.com', done);
       })
+
+      describe('when multiple X-Forwarded-Host', function () {
+        it('should use the first value', function (done) {
+          var app = express()
+
+          app.enable('trust proxy')
+
+          app.use(function (req, res) {
+            res.send(req.hostname)
+          })
+
+          request(app)
+          .get('/')
+          .set('Host', 'localhost')
+          .set('X-Forwarded-Host', 'example.com, foobar.com')
+          .expect(200, 'example.com', done)
+        })
+
+        it('should remove OWS around comma', function (done) {
+          var app = express()
+
+          app.enable('trust proxy')
+
+          app.use(function (req, res) {
+            res.send(req.hostname)
+          })
+
+          request(app)
+          .get('/')
+          .set('Host', 'localhost')
+          .set('X-Forwarded-Host', 'example.com , foobar.com')
+          .expect(200, 'example.com', done)
+        })
+
+        it('should strip port number', function (done) {
+          var app = express()
+
+          app.enable('trust proxy')
+
+          app.use(function (req, res) {
+            res.send(req.hostname)
+          })
+
+          request(app)
+          .get('/')
+          .set('Host', 'localhost')
+          .set('X-Forwarded-Host', 'example.com:8080 , foobar.com:8888')
+          .expect(200, 'example.com', done)
+        })
+      })
     })
 
     describe('when "trust proxy" is disabled', function(){

From 95c31f7041fe31b24175ce9a6537a0d0d6b807f7 Mon Sep 17 00:00:00 2001
From: HubCodes <krlrhkstk12@gmail.com>
Date: Thu, 13 Dec 2018 16:04:27 +0900
Subject: [PATCH 133/479] docs: fix typo in contributing

closes #3827
---
 Contributing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Contributing.md b/Contributing.md
index 41386568d64..f84c0138cb0 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -19,7 +19,7 @@ expertise to resolve rare disputes.
 
 Log an issue for any question or problem you might have. When in doubt, log an issue, and
 any additional policies about what to include will be provided in the responses. The only
-exception is security dislosures which should be sent privately.
+exception is security disclosures which should be sent privately.
 
 Committers may direct you to another repository, ask for additional clarifications, and
 add appropriate metadata before the issue is addressed.

From 0ae10bb15471745795a44d9316e324b697725524 Mon Sep 17 00:00:00 2001
From: Austin Scriver <ascriver@live.com>
Date: Mon, 26 Nov 2018 20:00:47 -0700
Subject: [PATCH 134/479] docs: fix typos in history

closes #3810
---
 History.md | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/History.md b/History.md
index c29a4490bd4..20cee356455 100644
--- a/History.md
+++ b/History.md
@@ -301,7 +301,7 @@ unreleased
     - Fix including type extensions in parameters in `Accept` parsing
     - Fix parsing `Accept` parameters with quoted equals
     - Fix parsing `Accept` parameters with quoted semicolons
-    - Many performance improvments
+    - Many performance improvements
     - deps: mime-types@~2.1.11
     - deps: negotiator@0.6.1
   * deps: content-type@~1.0.2
@@ -316,7 +316,7 @@ unreleased
     - perf: enable strict mode
     - perf: hoist regular expression
     - perf: use for loop in parse
-    - perf: use string concatination for serialization
+    - perf: use string concatenation for serialization
   * deps: finalhandler@0.5.0
     - Change invalid or non-numeric status code to 500
     - Overwrite status message to match set status code
@@ -326,7 +326,7 @@ unreleased
   * deps: proxy-addr@~1.1.2
     - Fix accepting various invalid netmasks
     - Fix IPv6-mapped IPv4 validation edge cases
-    - IPv4 netmasks must be contingous
+    - IPv4 netmasks must be contiguous
     - IPv6 addresses cannot be used as a netmask
     - deps: ipaddr.js@1.1.1
   * deps: qs@6.2.0
@@ -1104,13 +1104,13 @@ unreleased
    - deps: negotiator@0.4.6
  * deps: debug@1.0.2
  * deps: send@0.4.3
-   - Do not throw un-catchable error on file open race condition
+   - Do not throw uncatchable error on file open race condition
    - Use `escape-html` for HTML escaping
    - deps: debug@1.0.2
    - deps: finished@1.2.2
    - deps: fresh@0.2.2
  * deps: serve-static@1.2.3
-   - Do not throw un-catchable error on file open race condition
+   - Do not throw uncatchable error on file open race condition
    - deps: send@0.4.3
 
 4.4.2 / 2014-06-09
@@ -1990,7 +1990,7 @@ unreleased
    - deps: serve-static@1.2.3
  * deps: debug@1.0.2
  * deps: send@0.4.3
-   - Do not throw un-catchable error on file open race condition
+   - Do not throw uncatchable error on file open race condition
    - Use `escape-html` for HTML escaping
    - deps: debug@1.0.2
    - deps: finished@1.2.2
@@ -3175,7 +3175,7 @@ Shaw]
   * Updated haml submodule
   * Changed ETag; removed inode, modified time only
   * Fixed LF to CRLF for setting multiple cookies
-  * Fixed cookie complation; values are now urlencoded
+  * Fixed cookie compilation; values are now urlencoded
   * Fixed cookies parsing; accepts quoted values and url escaped cookies
 
 0.11.0 / 2010-05-06
@@ -3370,7 +3370,7 @@ Shaw]
 
   * Added "plot" format option for Profiler (for gnuplot processing)
   * Added request number to Profiler plugin
-  * Fixed binary encoding for multi-part file uploads, was previously defaulting to UTF8
+  * Fixed binary encoding for multipart file uploads, was previously defaulting to UTF8
   * Fixed issue with routes not firing when not files are present. Closes #184
   * Fixed process.Promise -> events.Promise
 
@@ -3416,7 +3416,7 @@ Shaw]
   * Updated sample chat app to show messages on load
   * Updated libxmljs parseString -> parseHtmlString
   * Fixed `make init` to work with older versions of git
-  * Fixed specs can now run independent specs for those who cant build deps. Closes #127
+  * Fixed specs can now run independent specs for those who can't build deps. Closes #127
   * Fixed issues introduced by the node url module changes. Closes 126.
   * Fixed two assertions failing due to Collection#keys() returning strings
   * Fixed faulty Collection#toArray() spec due to keys() returning strings

From 02f3933b6962114cf46c637105db7983d32a156a Mon Sep 17 00:00:00 2001
From: Alvin Smith <alvinsmith.nz@gmail.com>
Date: Thu, 29 Nov 2018 21:02:55 +1300
Subject: [PATCH 135/479] examples: minor fixes to some examples

closes #3812
---
 examples/downloads/index.js            | 2 +-
 examples/mvc/public/style.css          | 2 +-
 examples/static-files/public/js/app.js | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/downloads/index.js b/examples/downloads/index.js
index e6f3fa9db69..5f0772697c1 100644
--- a/examples/downloads/index.js
+++ b/examples/downloads/index.js
@@ -21,7 +21,7 @@ app.get('/files/:file(*)', function(req, res, next){
 
   res.download(filePath, function (err) {
     if (!err) return; // file sent
-    if (err && err.status !== 404) return next(err); // non-404 error
+    if (err.status !== 404) return next(err); // non-404 error
     // file for download not found
     res.statusCode = 404;
     res.send('Cant find that file, sorry!');
diff --git a/examples/mvc/public/style.css b/examples/mvc/public/style.css
index 69fde2e23aa..8a23f9d41c4 100644
--- a/examples/mvc/public/style.css
+++ b/examples/mvc/public/style.css
@@ -1,6 +1,6 @@
 body {
   padding: 50px;
-  font: 16px "Helvetica Neue", Helvetica, Arial;
+  font: 16px "Helvetica Neue", Helvetica, Arial, sans-serif;
 }
 a {
   color: #107aff;
diff --git a/examples/static-files/public/js/app.js b/examples/static-files/public/js/app.js
index 257cc5642cb..775eb734b02 100644
--- a/examples/static-files/public/js/app.js
+++ b/examples/static-files/public/js/app.js
@@ -1 +1 @@
-foo
+// foo

From 186a206a0aed799699e6a7400aed9aeef31c21e9 Mon Sep 17 00:00:00 2001
From: Ciro Santilli <ciro.santilli@gmail.com>
Date: Tue, 5 Feb 2019 09:39:46 +0000
Subject: [PATCH 136/479] docs: add listening address to example

closes #3873
---
 Readme.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Readme.md b/Readme.md
index 582e8958c59..9053d79006d 100644
--- a/Readme.md
+++ b/Readme.md
@@ -90,6 +90,8 @@ $ npm install
 $ npm start
 ```
 
+  View the website at: http://localhost:3000
+
 ## Philosophy
 
   The Express philosophy is to provide small, robust tooling for HTTP servers, making

From 6f12eee8abcfdd672c7a3d638d3dbf744a6b1801 Mon Sep 17 00:00:00 2001
From: Louis <artonge@chmn.me>
Date: Thu, 17 Jan 2019 18:33:01 +0100
Subject: [PATCH 137/479] docs: fix typo in jsdoc comment

closes #3859
---
 lib/response.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index 60f8979e859..c1514901c57 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -822,7 +822,7 @@ res.clearCookie = function clearCookie(name, options) {
  *    // "Remember Me" for 15 minutes
  *    res.cookie('rememberme', '1', { expires: new Date(Date.now() + 900000), httpOnly: true });
  *
- *    // save as above
+ *    // same as above
  *    res.cookie('rememberme', '1', { maxAge: 900000, httpOnly: true })
  *
  * @param {String} name

From b9b1b19758b0996680100c65ae87128d623c5f7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EA=B9=80=EC=A0=95=ED=99=98?= <jh.kim@woowahan.com>
Date: Fri, 1 Feb 2019 09:56:14 +0900
Subject: [PATCH 138/479] tests: fix typos in descriptions

closes #3875
---
 test/app.router.js           | 2 +-
 test/req.acceptsCharset.js   | 4 ++--
 test/req.acceptsCharsets.js  | 4 ++--
 test/req.acceptsEncodings.js | 2 +-
 test/req.query.js            | 2 +-
 test/res.download.js         | 4 ++--
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/test/app.router.js b/test/app.router.js
index d716ea4b046..5a31b5fb90c 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -567,7 +567,7 @@ describe('app.router', function(){
       .expect('/user/tobi.json', done)
     })
 
-    it('should decore the capture', function (done) {
+    it('should decode the capture', function (done) {
       var app = express()
 
       app.get('*', function (req, res) {
diff --git a/test/req.acceptsCharset.js b/test/req.acceptsCharset.js
index 0d0ed8b5e41..f7d0cc0e300 100644
--- a/test/req.acceptsCharset.js
+++ b/test/req.acceptsCharset.js
@@ -18,8 +18,8 @@ describe('req', function(){
       })
     })
 
-    describe('when Accept-Charset is not present', function(){
-      it('should return true when present', function(done){
+    describe('when Accept-Charset is present', function () {
+      it('should return true', function (done) {
         var app = express();
 
         app.use(function(req, res, next){
diff --git a/test/req.acceptsCharsets.js b/test/req.acceptsCharsets.js
index 2f4574c5244..d1c459174a9 100644
--- a/test/req.acceptsCharsets.js
+++ b/test/req.acceptsCharsets.js
@@ -18,8 +18,8 @@ describe('req', function(){
       })
     })
 
-    describe('when Accept-Charset is not present', function(){
-      it('should return true when present', function(done){
+    describe('when Accept-Charset is present', function () {
+      it('should return true', function (done) {
         var app = express();
 
         app.use(function(req, res, next){
diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
index aba8ea5fbeb..a5cf747d41c 100644
--- a/test/req.acceptsEncodings.js
+++ b/test/req.acceptsEncodings.js
@@ -3,7 +3,7 @@ var express = require('../')
   , request = require('supertest');
 
 describe('req', function(){
-  describe('.acceptsEncodingss', function(){
+  describe('.acceptsEncodings', function () {
     it('should be true if encoding accepted', function(done){
       var app = express();
 
diff --git a/test/req.query.js b/test/req.query.js
index d3d29abd16d..7819420ce01 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -70,7 +70,7 @@ describe('req', function(){
       });
     });
 
-    describe('when "query parser" disabled', function () {
+    describe('when "query parser" enabled', function () {
       it('should not parse complex keys', function (done) {
         var app = createApp(true);
 
diff --git a/test/res.download.js b/test/res.download.js
index 084b3c7164d..cf3b3ca53e1 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -110,7 +110,7 @@ describe('res', function(){
     })
 
     describe('when options.headers contains Content-Disposition', function () {
-      it('should should be ignored', function (done) {
+      it('should be ignored', function (done) {
         var app = express()
 
         app.use(function (req, res) {
@@ -130,7 +130,7 @@ describe('res', function(){
         .end(done)
       })
 
-      it('should should be ignored case-insensitively', function (done) {
+      it('should be ignored case-insensitively', function (done) {
         var app = express()
 
         app.use(function (req, res) {

From 6eda52a3dc953f297942a98c333b609519141c49 Mon Sep 17 00:00:00 2001
From: Marcin Wanago <wanago.marcin@gmail.com>
Date: Wed, 30 Jan 2019 23:42:29 +0100
Subject: [PATCH 139/479] docs: use const in readme example

fixes #3867
closes #3868
---
 Readme.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index 9053d79006d..b25b240c7da 100644
--- a/Readme.md
+++ b/Readme.md
@@ -9,8 +9,8 @@
   [![Test Coverage][coveralls-image]][coveralls-url]
 
 ```js
-var express = require('express')
-var app = express()
+const express = require('express')
+const app = express()
 
 app.get('/', function (req, res) {
   res.send('Hello World')

From 8a97346eaf3a5e39ba8185b244af4918d2ca43b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EA=B9=80=EC=A0=95=ED=99=98?= <6pack@madup.com>
Date: Fri, 1 Feb 2019 21:33:07 +0900
Subject: [PATCH 140/479] tests: assert calls order in middleware basic tests

closes #3878
---
 test/middleware.basic.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index ce59589230b..4616842ed60 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('../');
 var request = require('supertest');
 
@@ -33,6 +34,7 @@ describe('middleware', function(){
       .set('Content-Type', 'application/json')
       .send('{"foo":"bar"}')
       .expect('Content-Type', 'application/json')
+      .expect(function () { assert.deepEqual(calls, ['one', 'two']) })
       .expect(200, '{"foo":"bar"}', done)
     })
   })

From 9e5d1a30c3671f99b5d80a231b697a311f5fe489 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 10:44:27 -0400
Subject: [PATCH 141/479] build: test against Node.js 12.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index c802e4fd3a7..36e7e75e568 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,6 +16,8 @@ matrix:
   include:
     - node_js: "11"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "12"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From cf5c813d2f6499be2d38a55a26dd5bd1b71b749c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 15:51:33 -0400
Subject: [PATCH 142/479] build: hbs@4.0.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 74196ad68e2..0b8bec48632 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "ejs": "2.6.1",
     "eslint": "2.13.1",
     "express-session": "1.15.6",
-    "hbs": "4.0.1",
+    "hbs": "4.0.4",
     "istanbul": "0.4.5",
     "marked": "0.5.1",
     "method-override": "3.0.0",

From 4218d04183e0f7bd04f3db7d23b53d6d3857ed10 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 15:58:26 -0400
Subject: [PATCH 143/479] build: marked@0.6.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0b8bec48632..6dd72c1f7c0 100644
--- a/package.json
+++ b/package.json
@@ -68,7 +68,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.4",
     "istanbul": "0.4.5",
-    "marked": "0.5.1",
+    "marked": "0.6.2",
     "method-override": "3.0.0",
     "mocha": "5.2.0",
     "morgan": "1.9.1",

From 952484f73a84743c53abfc4b51a6614f2d1e13cd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 16:00:02 -0400
Subject: [PATCH 144/479] deps: content-disposition@0.5.3

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 20cee356455..5343b0ba85d 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
+  * deps: content-disposition@0.5.3
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index 6dd72c1f7c0..9255d77d07b 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "accepts": "~1.3.5",
     "array-flatten": "1.1.1",
     "body-parser": "1.18.3",
-    "content-disposition": "0.5.2",
+    "content-disposition": "0.5.3",
     "content-type": "~1.0.4",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",

From 50eb5e43774a78737a82405c17ac8ca3ff5532ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 16:05:17 -0400
Subject: [PATCH 145/479] deps: proxy-addr@~2.0.5

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5343b0ba85d..f8a5c0c0e10 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,8 @@ unreleased
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
   * deps: content-disposition@0.5.3
+  * deps: proxy-addr@~2.0.5
+    - deps: ipaddr.js@1.9.0
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index 9255d77d07b..92102c2a76f 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.4",
+    "proxy-addr": "~2.0.5",
     "qs": "6.5.2",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",

From 03341204ff13fb35ac7082adf3dd694081ab68d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 16:06:35 -0400
Subject: [PATCH 146/479] deps: parseurl@~1.3.3

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f8a5c0c0e10..e1f238bb90a 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
   * deps: content-disposition@0.5.3
+  * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
 
diff --git a/package.json b/package.json
index 92102c2a76f..e548b609272 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",
-    "parseurl": "~1.3.2",
+    "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.5",
     "qs": "6.5.2",

From b02d3a1744db80a1ad6951f55f4cb6b996db4b53 Mon Sep 17 00:00:00 2001
From: James George <jamesgeorge998001@gmail.com>
Date: Thu, 27 Dec 2018 12:59:51 +0530
Subject: [PATCH 147/479] docs: add link to contributing guide

closes #3846
---
 Readme.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Readme.md b/Readme.md
index b25b240c7da..81d8d91615e 100644
--- a/Readme.md
+++ b/Readme.md
@@ -127,6 +127,10 @@ $ npm install
 $ npm test
 ```
 
+## Contributing
+
+[Contributing Guide](Contributing.md)
+
 ## People
 
 The original author of Express is [TJ Holowaychuk](https://github.com/tj)

From 7eacdcef190990f2e5a199bb1140322c687e65d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 22 Apr 2019 13:40:23 -0400
Subject: [PATCH 148/479] deps: setprototypeof@1.1.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e1f238bb90a..4f9dcbe96ff 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,7 @@ unreleased
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
+  * deps: setprototypeof@1.1.1
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index e548b609272..719d689137c 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "safe-buffer": "5.1.2",
     "send": "0.16.2",
     "serve-static": "1.13.2",
-    "setprototypeof": "1.1.0",
+    "setprototypeof": "1.1.1",
     "statuses": "~1.4.0",
     "type-is": "~1.6.16",
     "utils-merge": "1.0.1",

From 9afa1cfc85171dfd8b3595e7b25b7be783c79ae8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 22:17:03 -0400
Subject: [PATCH 149/479] deps: statuses@~1.5.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4f9dcbe96ff..f0001629d88 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@ unreleased
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
   * deps: setprototypeof@1.1.1
+  * deps: statuses@~1.5.0
+    - Add `103 Early Hints`
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index 719d689137c..3834b1f1d2f 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "send": "0.16.2",
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.1",
-    "statuses": "~1.4.0",
+    "statuses": "~1.5.0",
     "type-is": "~1.6.16",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"

From 40dbfa2de21588d23a8e8e8d43dae5664f0267af Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 22:24:35 -0400
Subject: [PATCH 150/479] deps: accepts@~1.3.7

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f0001629d88..850f4333cff 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
+  * deps: accepts@~1.3.7
   * deps: content-disposition@0.5.3
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
diff --git a/package.json b/package.json
index 3834b1f1d2f..ee093cc1acb 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.3.5",
+    "accepts": "~1.3.7",
     "array-flatten": "1.1.1",
     "body-parser": "1.18.3",
     "content-disposition": "0.5.3",

From 6d9dd2da49c8d5fce9fccdd9d8257004040a19a7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 22:48:56 -0400
Subject: [PATCH 151/479] deps: type-is@~1.6.18

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 850f4333cff..6a7aab401c6 100644
--- a/History.md
+++ b/History.md
@@ -12,6 +12,9 @@ unreleased
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
+  * deps: type-is@~1.6.18
+    - deps: mime-types@~2.1.24
+    - perf: prevent internal `throw` on invalid type
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index ee093cc1acb..efb712f81fd 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",
-    "type-is": "~1.6.16",
+    "type-is": "~1.6.18",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"
   },

From 32f5293afa2edb7dd9052922dda3ebdd9eab658d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 23:06:50 -0400
Subject: [PATCH 152/479] deps: qs@6.7.0

---
 History.md        | 2 ++
 package.json      | 2 +-
 test/req.query.js | 4 ++--
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 6a7aab401c6..5051207e8ac 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@ unreleased
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
+  * deps: qs@6.7.0
+    - Fix parsing array brackets after index
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
diff --git a/package.json b/package.json
index efb712f81fd..9730acccbb4 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.5",
-    "qs": "6.5.2",
+    "qs": "6.7.0",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
     "send": "0.16.2",
diff --git a/test/req.query.js b/test/req.query.js
index 7819420ce01..0e810b8ef91 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -25,8 +25,8 @@ describe('req', function(){
         var app = createApp('extended');
 
         request(app)
-        .get('/?user[name]=tj')
-        .expect(200, '{"user":{"name":"tj"}}', done);
+        .get('/?foo[0][bar]=baz&foo[0][fizz]=buzz&foo[]=done!')
+        .expect(200, '{"foo":[{"bar":"baz","fizz":"buzz"},"done!"]}', done);
       });
 
       it('should parse parameters with dots', function (done) {

From 2f782d8478948124a1c96fe04de259385163100f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 23:31:32 -0400
Subject: [PATCH 153/479] deps: body-parser@1.19.0

---
 History.md   | 10 ++++++++++
 package.json |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5051207e8ac..3c2b59a6e22 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,16 @@ unreleased
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
   * deps: accepts@~1.3.7
+  * deps: body-parser@1.19.0
+    - Add encoding MIK
+    - Add petabyte (`pb`) support
+    - Fix parsing array brackets after index
+    - deps: bytes@3.1.0
+    - deps: http-errors@1.7.2
+    - deps: iconv-lite@0.4.24
+    - deps: qs@6.7.0
+    - deps: raw-body@2.4.0
+    - deps: type-is@~1.6.17
   * deps: content-disposition@0.5.3
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
diff --git a/package.json b/package.json
index 9730acccbb4..b443c34c82e 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
   "dependencies": {
     "accepts": "~1.3.7",
     "array-flatten": "1.1.1",
-    "body-parser": "1.18.3",
+    "body-parser": "1.19.0",
     "content-disposition": "0.5.3",
     "content-type": "~1.0.4",
     "cookie": "0.3.1",

From 955f2a5f78c75cd58f8c4517725a14dd3ee199a4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 May 2019 22:59:42 -0400
Subject: [PATCH 154/479] tests: add express.json test suite

---
 test/exports.js      |   6 +
 test/express.json.js | 664 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 670 insertions(+)
 create mode 100644 test/express.json.js

diff --git a/test/exports.js b/test/exports.js
index 2a80eedbbe8..bc2bb410fce 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('../');
 var request = require('supertest');
 var should = require('should');
@@ -8,6 +9,11 @@ describe('exports', function(){
     express.Router.should.be.a.Function()
   })
 
+  it('should expose json middleware', function () {
+    assert.equal(typeof express.json, 'function')
+    assert.equal(express.json.length, 1)
+  })
+
   it('should expose the application prototype', function(){
     express.application.set.should.be.a.Function()
   })
diff --git a/test/express.json.js b/test/express.json.js
new file mode 100644
index 00000000000..907fa0cfeb8
--- /dev/null
+++ b/test/express.json.js
@@ -0,0 +1,664 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var request = require('supertest')
+
+describe('express.json()', function () {
+  it('should parse JSON', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .send('{"user":"tobi"}')
+      .expect(200, '{"user":"tobi"}', done)
+  })
+
+  it('should handle Content-Length: 0', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .set('Content-Length', '0')
+      .expect(200, '{}', done)
+  })
+
+  it('should handle empty message-body', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .set('Transfer-Encoding', 'chunked')
+      .expect(200, '{}', done)
+  })
+
+  it('should handle no message-body', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .unset('Transfer-Encoding')
+      .expect(200, '{}', done)
+  })
+
+  it('should 400 when invalid content-length', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.headers['content-length'] = '20' // bad length
+      next()
+    })
+
+    app.use(express.json())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .send('{"str":')
+      .expect(400, /content length/, done)
+  })
+
+  it('should handle duplicated middleware', function (done) {
+    var app = express()
+
+    app.use(express.json())
+    app.use(express.json())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .send('{"user":"tobi"}')
+      .expect(200, '{"user":"tobi"}', done)
+  })
+
+  describe('when JSON is invalid', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should 400 for bad token', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{:')
+        .expect(400, parseError('{:'), done)
+    })
+
+    it('should 400 for incomplete', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{"user"')
+        .expect(400, parseError('{"user"'), done)
+    })
+
+    it('should error with type = "entity.parse.failed"', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'type')
+        .send(' {"user"')
+        .expect(400, 'entity.parse.failed', done)
+    })
+
+    it('should include original body on error object', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'body')
+        .send(' {"user"')
+        .expect(400, ' {"user"', done)
+    })
+  })
+
+  describe('with limit option', function () {
+    it('should 413 when over limit with Content-Length', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: '1kb' }))
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('Content-Length', '1034')
+        .send(JSON.stringify({ str: buf.toString() }))
+        .expect(413, done)
+    })
+
+    it('should error with type = "entity.too.large"', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: '1kb' }))
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('Content-Length', '1034')
+        .set('X-Error-Property', 'type')
+        .send(JSON.stringify({ str: buf.toString() }))
+        .expect(413, 'entity.too.large', done)
+    })
+
+    it('should 413 when over limit with chunked encoding', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      var server = createApp({ limit: '1kb' })
+      var test = request(server).post('/')
+      test.set('Content-Type', 'application/json')
+      test.set('Transfer-Encoding', 'chunked')
+      test.write('{"str":')
+      test.write('"' + buf.toString() + '"}')
+      test.expect(413, done)
+    })
+
+    it('should accept number of bytes', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: 1024 }))
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send(JSON.stringify({ str: buf.toString() }))
+        .expect(413, done)
+    })
+
+    it('should not change when options altered', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      var options = { limit: '1kb' }
+      var server = createApp(options)
+
+      options.limit = '100kb'
+
+      request(server)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send(JSON.stringify({ str: buf.toString() }))
+        .expect(413, done)
+    })
+
+    it('should not hang response', function (done) {
+      var buf = Buffer.alloc(10240, '.')
+      var server = createApp({ limit: '8kb' })
+      var test = request(server).post('/')
+      test.set('Content-Type', 'application/json')
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(413, done)
+    })
+  })
+
+  describe('with inflate option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ inflate: false })
+      })
+
+      it('should not accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/json')
+        test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+        test.expect(415, 'content encoding unsupported', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ inflate: true })
+      })
+
+      it('should accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/json')
+        test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+        test.expect(200, '{"name":"论"}', done)
+      })
+    })
+  })
+
+  describe('with strict option', function () {
+    describe('when undefined', function () {
+      before(function () {
+        this.app = createApp()
+      })
+
+      it('should 400 on primitives', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('true')
+          .expect(400, parseError('#rue').replace('#', 't'), done)
+      })
+    })
+
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ strict: false })
+      })
+
+      it('should parse primitives', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('true')
+          .expect(200, 'true', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ strict: true })
+      })
+
+      it('should not parse primitives', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('true')
+          .expect(400, parseError('#rue').replace('#', 't'), done)
+      })
+
+      it('should not parse primitives with leading whitespaces', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('    true')
+          .expect(400, parseError('    #rue').replace('#', 't'), done)
+      })
+
+      it('should allow leading whitespaces in JSON', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('   { "user": "tobi" }')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should error with type = "entity.parse.failed"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .set('X-Error-Property', 'type')
+          .send('true')
+          .expect(400, 'entity.parse.failed', done)
+      })
+
+      it('should include correct message in stack trace', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .set('X-Error-Property', 'stack')
+          .send('true')
+          .expect(400)
+          .expect(shouldContainInBody(parseError('#rue').replace('#', 't')))
+          .end(done)
+      })
+    })
+  })
+
+  describe('with type option', function () {
+    describe('when "application/vnd.api+json"', function () {
+      before(function () {
+        this.app = createApp({ type: 'application/vnd.api+json' })
+      })
+
+      it('should parse JSON for custom type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.api+json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should ignore standard type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when ["application/json", "application/vnd.api+json"]', function () {
+      before(function () {
+        this.app = createApp({
+          type: ['application/json', 'application/vnd.api+json']
+        })
+      })
+
+      it('should parse JSON for "application/json"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should parse JSON for "application/vnd.api+json"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.api+json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should ignore "application/x-json"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when a function', function () {
+      it('should parse when truthy value returned', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return req.headers['content-type'] === 'application/vnd.api+json'
+        }
+
+        request(app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.api+json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should work without content-type', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return true
+        }
+
+        var test = request(app).post('/')
+        test.write('{"user":"tobi"}')
+        test.expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should not invoke without a body', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          throw new Error('oops!')
+        }
+
+        request(app)
+          .get('/')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('with verify option', function () {
+    it('should assert value if function', function () {
+      assert.throws(createApp.bind(null, { verify: 'lol' }),
+        /TypeError: option verify must be function/)
+    })
+
+    it('should error from verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('["tobi"]')
+        .expect(403, 'no arrays', done)
+    })
+
+    it('should error with type = "entity.verify.failed"', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'type')
+        .send('["tobi"]')
+        .expect(403, 'entity.verify.failed', done)
+    })
+
+    it('should allow custom codes', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x5b) return
+        var err = new Error('no arrays')
+        err.status = 400
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('["tobi"]')
+        .expect(400, 'no arrays', done)
+    })
+
+    it('should allow custom type', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x5b) return
+        var err = new Error('no arrays')
+        err.type = 'foo.bar'
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'type')
+        .send('["tobi"]')
+        .expect(403, 'foo.bar', done)
+    })
+
+    it('should include original body on error object', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'body')
+        .send('["tobi"]')
+        .expect(403, '["tobi"]', done)
+    })
+
+    it('should allow pass-through', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{"user":"tobi"}')
+        .expect(200, '{"user":"tobi"}', done)
+    })
+
+    it('should work with different charsets', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/json; charset=utf-16')
+      test.write(Buffer.from('feff007b0022006e0061006d00650022003a00228bba0022007d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should 415 on unknown charset prior to verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        throw new Error('unexpected verify call')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/json; charset=x-bogus')
+      test.write(Buffer.from('00000000', 'hex'))
+      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describe('charset', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should parse utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=utf-8')
+      test.write(Buffer.from('7b226e616d65223a22e8aeba227d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should parse utf-16', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=utf-16')
+      test.write(Buffer.from('feff007b0022006e0061006d00650022003a00228bba0022007d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should parse when content-length != char length', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=utf-8')
+      test.set('Content-Length', '13')
+      test.write(Buffer.from('7b2274657374223a22c3a5227d', 'hex'))
+      test.expect(200, '{"test":"å"}', done)
+    })
+
+    it('should default to utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('7b226e616d65223a22e8aeba227d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should fail on unknown charset', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=koi8-r')
+      test.write(Buffer.from('7b226e616d65223a22cec5d4227d', 'hex'))
+      test.expect(415, 'unsupported charset "KOI8-R"', done)
+    })
+
+    it('should error with type = "charset.unsupported"', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=koi8-r')
+      test.set('X-Error-Property', 'type')
+      test.write(Buffer.from('7b226e616d65223a22cec5d4227d', 'hex'))
+      test.expect(415, 'charset.unsupported', done)
+    })
+  })
+
+  describe('encoding', function () {
+    before(function () {
+      this.app = createApp({ limit: '1kb' })
+    })
+
+    it('should parse without encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('7b226e616d65223a22e8aeba227d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support identity encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'identity')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('7b226e616d65223a22e8aeba227d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support gzip encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support deflate encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'deflate')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('789cab56ca4bcc4d55b2527ab16e97522d00274505ac', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should be case-insensitive', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'GZIP')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should 415 on unknown encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'unsupported content encoding "nulls"', done)
+    })
+
+    it('should error with type = "encoding.unsupported"', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'application/json')
+      test.set('X-Error-Property', 'type')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'encoding.unsupported', done)
+    })
+
+    it('should 400 on malformed encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bab56cc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+      test.expect(400, done)
+    })
+
+    it('should 413 when inflated value exceeds limit', function (done) {
+      // gzip'd data exceeds 1kb, but deflated below 1kb
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bedc1010d000000c2a0f74f6d0f071400000000000000', 'hex'))
+      test.write(Buffer.from('0000000000000000000000000000000000000000000000000000000000000000', 'hex'))
+      test.write(Buffer.from('0000000000000000004f0625b3b71650c30000', 'hex'))
+      test.expect(413, done)
+    })
+  })
+})
+
+function createApp (options) {
+  var app = express()
+
+  app.use(express.json(options))
+
+  app.use(function (err, req, res, next) {
+    res.status(err.status || 500)
+    res.send(String(err[req.headers['x-error-property'] || 'message']))
+  })
+
+  app.post('/', function (req, res) {
+    res.json(req.body)
+  })
+
+  return app
+}
+
+function parseError (str) {
+  try {
+    JSON.parse(str); throw new SyntaxError('strict violation')
+  } catch (e) {
+    return e.message
+  }
+}
+
+function shouldContainInBody (str) {
+  return function (res) {
+    assert.ok(res.text.indexOf(str) !== -1,
+      'expected \'' + res.text + '\' to contain \'' + str + '\'')
+  }
+}

From 8b71f39516135f8b729de3456f3ae7f6d33442a1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 May 2019 23:29:28 -0400
Subject: [PATCH 155/479] tests: add express.urlencoded test suite

---
 test/exports.js            |   5 +
 test/express.urlencoded.js | 734 +++++++++++++++++++++++++++++++++++++
 test/support/env.js        |   2 +-
 3 files changed, 740 insertions(+), 1 deletion(-)
 create mode 100644 test/express.urlencoded.js

diff --git a/test/exports.js b/test/exports.js
index bc2bb410fce..57b3265bd6f 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -14,6 +14,11 @@ describe('exports', function(){
     assert.equal(express.json.length, 1)
   })
 
+  it('should expose urlencoded middleware', function () {
+    assert.equal(typeof express.urlencoded, 'function')
+    assert.equal(express.urlencoded.length, 1)
+  })
+
   it('should expose the application prototype', function(){
     express.application.set.should.be.a.Function()
   })
diff --git a/test/express.urlencoded.js b/test/express.urlencoded.js
new file mode 100644
index 00000000000..6011de05f7a
--- /dev/null
+++ b/test/express.urlencoded.js
@@ -0,0 +1,734 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var request = require('supertest')
+
+describe('express.urlencoded()', function () {
+  before(function () {
+    this.app = createApp()
+  })
+
+  it('should parse x-www-form-urlencoded', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('user=tobi')
+      .expect(200, '{"user":"tobi"}', done)
+  })
+
+  it('should 400 when invalid content-length', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.headers['content-length'] = '20' // bad length
+      next()
+    })
+
+    app.use(express.urlencoded())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('str=')
+      .expect(400, /content length/, done)
+  })
+
+  it('should handle Content-Length: 0', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .set('Content-Length', '0')
+      .send('')
+      .expect(200, '{}', done)
+  })
+
+  it('should handle empty message-body', function (done) {
+    request(createApp({ limit: '1kb' }))
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .set('Transfer-Encoding', 'chunked')
+      .send('')
+      .expect(200, '{}', done)
+  })
+
+  it('should handle duplicated middleware', function (done) {
+    var app = express()
+
+    app.use(express.urlencoded())
+    app.use(express.urlencoded())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('user=tobi')
+      .expect(200, '{"user":"tobi"}', done)
+  })
+
+  it('should parse extended syntax', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('user[name][first]=Tobi')
+      .expect(200, '{"user":{"name":{"first":"Tobi"}}}', done)
+  })
+
+  describe('with extended option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ extended: false })
+      })
+
+      it('should not parse extended syntax', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user[name][first]=Tobi')
+          .expect(200, '{"user[name][first]":"Tobi"}', done)
+      })
+
+      it('should parse multiple key instances', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user=Tobi&user=Loki')
+          .expect(200, '{"user":["Tobi","Loki"]}', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ extended: true })
+      })
+
+      it('should parse multiple key instances', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user=Tobi&user=Loki')
+          .expect(200, '{"user":["Tobi","Loki"]}', done)
+      })
+
+      it('should parse extended syntax', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user[name][first]=Tobi')
+          .expect(200, '{"user":{"name":{"first":"Tobi"}}}', done)
+      })
+
+      it('should parse parameters with dots', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user.name=Tobi')
+          .expect(200, '{"user.name":"Tobi"}', done)
+      })
+
+      it('should parse fully-encoded extended syntax', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user%5Bname%5D%5Bfirst%5D=Tobi')
+          .expect(200, '{"user":{"name":{"first":"Tobi"}}}', done)
+      })
+
+      it('should parse array index notation', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('foo[0]=bar&foo[1]=baz')
+          .expect(200, '{"foo":["bar","baz"]}', done)
+      })
+
+      it('should parse array index notation with large array', function (done) {
+        var str = 'f[0]=0'
+
+        for (var i = 1; i < 500; i++) {
+          str += '&f[' + i + ']=' + i.toString(16)
+        }
+
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(str)
+          .expect(function (res) {
+            var obj = JSON.parse(res.text)
+            assert.strictEqual(Object.keys(obj).length, 1)
+            assert.strictEqual(Array.isArray(obj.f), true)
+            assert.strictEqual(obj.f.length, 500)
+          })
+          .expect(200, done)
+      })
+
+      it('should parse array of objects syntax', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('foo[0][bar]=baz&foo[0][fizz]=buzz&foo[]=done!')
+          .expect(200, '{"foo":[{"bar":"baz","fizz":"buzz"},"done!"]}', done)
+      })
+
+      it('should parse deep object', function (done) {
+        var str = 'foo'
+
+        for (var i = 0; i < 500; i++) {
+          str += '[p]'
+        }
+
+        str += '=bar'
+
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(str)
+          .expect(function (res) {
+            var obj = JSON.parse(res.text)
+            assert.strictEqual(Object.keys(obj).length, 1)
+            assert.strictEqual(typeof obj.foo, 'object')
+
+            var depth = 0
+            var ref = obj.foo
+            while ((ref = ref.p)) { depth++ }
+            assert.strictEqual(depth, 500)
+          })
+          .expect(200, done)
+      })
+    })
+  })
+
+  describe('with inflate option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ inflate: false })
+      })
+
+      it('should not accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/x-www-form-urlencoded')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+        test.expect(415, 'content encoding unsupported', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ inflate: true })
+      })
+
+      it('should accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/x-www-form-urlencoded')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+        test.expect(200, '{"name":"论"}', done)
+      })
+    })
+  })
+
+  describe('with limit option', function () {
+    it('should 413 when over limit with Content-Length', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: '1kb' }))
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .set('Content-Length', '1028')
+        .send('str=' + buf.toString())
+        .expect(413, done)
+    })
+
+    it('should 413 when over limit with chunked encoding', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.set('Transfer-Encoding', 'chunked')
+      test.write('str=')
+      test.write(buf.toString())
+      test.expect(413, done)
+    })
+
+    it('should accept number of bytes', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: 1024 }))
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('str=' + buf.toString())
+        .expect(413, done)
+    })
+
+    it('should not change when options altered', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      var options = { limit: '1kb' }
+      var app = createApp(options)
+
+      options.limit = '100kb'
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('str=' + buf.toString())
+        .expect(413, done)
+    })
+
+    it('should not hang response', function (done) {
+      var buf = Buffer.alloc(10240, '.')
+      var app = createApp({ limit: '8kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(413, done)
+    })
+  })
+
+  describe('with parameterLimit option', function () {
+    describe('with extended: false', function () {
+      it('should reject 0', function () {
+        assert.throws(createApp.bind(null, { extended: false, parameterLimit: 0 }),
+          /TypeError: option parameterLimit must be a positive number/)
+      })
+
+      it('should reject string', function () {
+        assert.throws(createApp.bind(null, { extended: false, parameterLimit: 'beep' }),
+          /TypeError: option parameterLimit must be a positive number/)
+      })
+
+      it('should 413 if over limit', function (done) {
+        request(createApp({ extended: false, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(11))
+          .expect(413, /too many parameters/, done)
+      })
+
+      it('should error with type = "parameters.too.many"', function (done) {
+        request(createApp({ extended: false, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .set('X-Error-Property', 'type')
+          .send(createManyParams(11))
+          .expect(413, 'parameters.too.many', done)
+      })
+
+      it('should work when at the limit', function (done) {
+        request(createApp({ extended: false, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(10))
+          .expect(expectKeyCount(10))
+          .expect(200, done)
+      })
+
+      it('should work if number is floating point', function (done) {
+        request(createApp({ extended: false, parameterLimit: 10.1 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(11))
+          .expect(413, /too many parameters/, done)
+      })
+
+      it('should work with large limit', function (done) {
+        request(createApp({ extended: false, parameterLimit: 5000 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(5000))
+          .expect(expectKeyCount(5000))
+          .expect(200, done)
+      })
+
+      it('should work with Infinity limit', function (done) {
+        request(createApp({ extended: false, parameterLimit: Infinity }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(10000))
+          .expect(expectKeyCount(10000))
+          .expect(200, done)
+      })
+    })
+
+    describe('with extended: true', function () {
+      it('should reject 0', function () {
+        assert.throws(createApp.bind(null, { extended: true, parameterLimit: 0 }),
+          /TypeError: option parameterLimit must be a positive number/)
+      })
+
+      it('should reject string', function () {
+        assert.throws(createApp.bind(null, { extended: true, parameterLimit: 'beep' }),
+          /TypeError: option parameterLimit must be a positive number/)
+      })
+
+      it('should 413 if over limit', function (done) {
+        request(createApp({ extended: true, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(11))
+          .expect(413, /too many parameters/, done)
+      })
+
+      it('should error with type = "parameters.too.many"', function (done) {
+        request(createApp({ extended: true, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .set('X-Error-Property', 'type')
+          .send(createManyParams(11))
+          .expect(413, 'parameters.too.many', done)
+      })
+
+      it('should work when at the limit', function (done) {
+        request(createApp({ extended: true, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(10))
+          .expect(expectKeyCount(10))
+          .expect(200, done)
+      })
+
+      it('should work if number is floating point', function (done) {
+        request(createApp({ extended: true, parameterLimit: 10.1 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(11))
+          .expect(413, /too many parameters/, done)
+      })
+
+      it('should work with large limit', function (done) {
+        request(createApp({ extended: true, parameterLimit: 5000 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(5000))
+          .expect(expectKeyCount(5000))
+          .expect(200, done)
+      })
+
+      it('should work with Infinity limit', function (done) {
+        request(createApp({ extended: true, parameterLimit: Infinity }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(10000))
+          .expect(expectKeyCount(10000))
+          .expect(200, done)
+      })
+    })
+  })
+
+  describe('with type option', function () {
+    describe('when "application/vnd.x-www-form-urlencoded"', function () {
+      before(function () {
+        this.app = createApp({ type: 'application/vnd.x-www-form-urlencoded' })
+      })
+
+      it('should parse for custom type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.x-www-form-urlencoded')
+          .send('user=tobi')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should ignore standard type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user=tobi')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when ["urlencoded", "application/x-pairs"]', function () {
+      before(function () {
+        this.app = createApp({
+          type: ['urlencoded', 'application/x-pairs']
+        })
+      })
+
+      it('should parse "application/x-www-form-urlencoded"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user=tobi')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should parse "application/x-pairs"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-pairs')
+          .send('user=tobi')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should ignore application/x-foo', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-foo')
+          .send('user=tobi')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when a function', function () {
+      it('should parse when truthy value returned', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return req.headers['content-type'] === 'application/vnd.something'
+        }
+
+        request(app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.something')
+          .send('user=tobi')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should work without content-type', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return true
+        }
+
+        var test = request(app).post('/')
+        test.write('user=tobi')
+        test.expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should not invoke without a body', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          throw new Error('oops!')
+        }
+
+        request(app)
+          .get('/')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('with verify option', function () {
+    it('should assert value if function', function () {
+      assert.throws(createApp.bind(null, { verify: 'lol' }),
+        /TypeError: option verify must be function/)
+    })
+
+    it('should error from verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x20) throw new Error('no leading space')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send(' user=tobi')
+        .expect(403, 'no leading space', done)
+    })
+
+    it('should error with type = "entity.verify.failed"', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x20) throw new Error('no leading space')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .set('X-Error-Property', 'type')
+        .send(' user=tobi')
+        .expect(403, 'entity.verify.failed', done)
+    })
+
+    it('should allow custom codes', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x20) return
+        var err = new Error('no leading space')
+        err.status = 400
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send(' user=tobi')
+        .expect(400, 'no leading space', done)
+    })
+
+    it('should allow custom type', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x20) return
+        var err = new Error('no leading space')
+        err.type = 'foo.bar'
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .set('X-Error-Property', 'type')
+        .send(' user=tobi')
+        .expect(403, 'foo.bar', done)
+    })
+
+    it('should allow pass-through', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('user=tobi')
+        .expect(200, '{"user":"tobi"}', done)
+    })
+
+    it('should 415 on unknown charset prior to verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        throw new Error('unexpected verify call')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded; charset=x-bogus')
+      test.write(Buffer.from('00000000', 'hex'))
+      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describe('charset', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should parse utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded; charset=utf-8')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should parse when content-length != char length', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded; charset=utf-8')
+      test.set('Content-Length', '7')
+      test.write(Buffer.from('746573743dc3a5', 'hex'))
+      test.expect(200, '{"test":"å"}', done)
+    })
+
+    it('should default to utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should fail on unknown charset', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded; charset=koi8-r')
+      test.write(Buffer.from('6e616d653dcec5d4', 'hex'))
+      test.expect(415, 'unsupported charset "KOI8-R"', done)
+    })
+  })
+
+  describe('encoding', function () {
+    before(function () {
+      this.app = createApp({ limit: '10kb' })
+    })
+
+    it('should parse without encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support identity encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'identity')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support gzip encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support deflate encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'deflate')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('789ccb4bcc4db57db16e17001068042f', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should be case-insensitive', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'GZIP')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should fail on unknown encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'unsupported content encoding "nulls"', done)
+    })
+  })
+})
+
+function createManyParams (count) {
+  var str = ''
+
+  if (count === 0) {
+    return str
+  }
+
+  str += '0=0'
+
+  for (var i = 1; i < count; i++) {
+    var n = i.toString(36)
+    str += '&' + n + '=' + n
+  }
+
+  return str
+}
+
+function createApp (options) {
+  var app = express()
+
+  app.use(express.urlencoded(options))
+
+  app.use(function (err, req, res, next) {
+    res.status(err.status || 500)
+    res.send(String(err[req.headers['x-error-property'] || 'message']))
+  })
+
+  app.post('/', function (req, res) {
+    res.json(req.body)
+  })
+
+  return app
+}
+
+function expectKeyCount (count) {
+  return function (res) {
+    assert.strictEqual(Object.keys(JSON.parse(res.text)).length, count)
+  }
+}
diff --git a/test/support/env.js b/test/support/env.js
index 0701f5e334f..000638ceeae 100644
--- a/test/support/env.js
+++ b/test/support/env.js
@@ -1,3 +1,3 @@
 
 process.env.NODE_ENV = 'test';
-process.env.NO_DEPRECATION = 'express';
+process.env.NO_DEPRECATION = 'body-parser,express';

From 6f7a8301a1828febe0b10af62152558d118b039c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 2 May 2019 17:49:29 -0400
Subject: [PATCH 156/479] tests: add express.static test suite

---
 test/exports.js                            |   5 +
 test/express.static.js                     | 813 +++++++++++++++++++++
 test/fixtures/empty.txt                    |   0
 test/fixtures/nums.txt                     |   1 +
 test/fixtures/pets/names.txt               |   1 +
 "test/fixtures/snow \342\230\203/.gitkeep" |   0
 test/fixtures/todo.html                    |   1 +
 test/fixtures/todo.txt                     |   1 +
 test/fixtures/users/index.html             |   1 +
 test/fixtures/users/tobi.txt               |   1 +
 test/support/utils.js                      |  34 +
 11 files changed, 858 insertions(+)
 create mode 100644 test/express.static.js
 create mode 100644 test/fixtures/empty.txt
 create mode 100644 test/fixtures/nums.txt
 create mode 100644 test/fixtures/pets/names.txt
 create mode 100644 "test/fixtures/snow \342\230\203/.gitkeep"
 create mode 100644 test/fixtures/todo.html
 create mode 100644 test/fixtures/todo.txt
 create mode 100644 test/fixtures/users/index.html
 create mode 100644 test/fixtures/users/tobi.txt

diff --git a/test/exports.js b/test/exports.js
index 57b3265bd6f..e5fb6f2a9cf 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -14,6 +14,11 @@ describe('exports', function(){
     assert.equal(express.json.length, 1)
   })
 
+  it('should expose static middleware', function () {
+    assert.equal(typeof express.static, 'function')
+    assert.equal(express.static.length, 2)
+  })
+
   it('should expose urlencoded middleware', function () {
     assert.equal(typeof express.urlencoded, 'function')
     assert.equal(express.urlencoded.length, 1)
diff --git a/test/express.static.js b/test/express.static.js
new file mode 100644
index 00000000000..7c9852243e6
--- /dev/null
+++ b/test/express.static.js
@@ -0,0 +1,813 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var path = require('path')
+var request = require('supertest')
+var utils = require('./support/utils')
+
+var fixtures = path.join(__dirname, '/fixtures')
+var relative = path.relative(process.cwd(), fixtures)
+
+var skipRelative = ~relative.indexOf('..') || path.resolve(relative) === relative
+
+describe('express.static()', function () {
+  describe('basic operations', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should require root path', function () {
+      assert.throws(express.static.bind(), /root path required/)
+    })
+
+    it('should require root path to be string', function () {
+      assert.throws(express.static.bind(null, 42), /root path.*string/)
+    })
+
+    it('should serve static files', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect(200, '- groceries', done)
+    })
+
+    it('should support nesting', function (done) {
+      request(this.app)
+        .get('/users/tobi.txt')
+        .expect(200, 'ferret', done)
+    })
+
+    it('should set Content-Type', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect('Content-Type', 'text/plain; charset=UTF-8')
+        .expect(200, done)
+    })
+
+    it('should set Last-Modified', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect('Last-Modified', /\d{2} \w{3} \d{4}/)
+        .expect(200, done)
+    })
+
+    it('should default max-age=0', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect('Cache-Control', 'public, max-age=0')
+        .expect(200, done)
+    })
+
+    it('should support urlencoded pathnames', function (done) {
+      request(this.app)
+        .get('/%25%20of%20dogs.txt')
+        .expect(200, '20%', done)
+    })
+
+    it('should not choke on auth-looking URL', function (done) {
+      request(this.app)
+        .get('//todo@txt')
+        .expect(404, 'Not Found', done)
+    })
+
+    it('should support index.html', function (done) {
+      request(this.app)
+        .get('/users/')
+        .expect(200)
+        .expect('Content-Type', /html/)
+        .expect('<p>tobi, loki, jane</p>', done)
+    })
+
+    it('should support ../', function (done) {
+      request(this.app)
+        .get('/users/../todo.txt')
+        .expect(200, '- groceries', done)
+    })
+
+    it('should support HEAD', function (done) {
+      request(this.app)
+        .head('/todo.txt')
+        .expect(200)
+        .expect(utils.shouldNotHaveBody())
+        .end(done)
+    })
+
+    it('should skip POST requests', function (done) {
+      request(this.app)
+        .post('/todo.txt')
+        .expect(404, 'Not Found', done)
+    })
+
+    it('should support conditional requests', function (done) {
+      var app = this.app
+
+      request(app)
+        .get('/todo.txt')
+        .end(function (err, res) {
+          if (err) throw err
+          request(app)
+            .get('/todo.txt')
+            .set('If-None-Match', res.headers.etag)
+            .expect(304, done)
+        })
+    })
+
+    it('should support precondition checks', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .set('If-Match', '"foo"')
+        .expect(412, done)
+    })
+
+    it('should serve zero-length files', function (done) {
+      request(this.app)
+        .get('/empty.txt')
+        .expect(200, '', done)
+    })
+
+    it('should ignore hidden files', function (done) {
+      request(this.app)
+        .get('/.name')
+        .expect(404, 'Not Found', done)
+    })
+  });
+
+  (skipRelative ? describe.skip : describe)('current dir', function () {
+    before(function () {
+      this.app = createApp('.')
+    })
+
+    it('should be served with "."', function (done) {
+      var dest = relative.split(path.sep).join('/')
+      request(this.app)
+        .get('/' + dest + '/todo.txt')
+        .expect(200, '- groceries', done)
+    })
+  })
+
+  describe('acceptRanges', function () {
+    describe('when false', function () {
+      it('should not include Accept-Ranges', function (done) {
+        request(createApp(fixtures, { 'acceptRanges': false }))
+          .get('/nums.txt')
+          .expect(utils.shouldNotHaveHeader('Accept-Ranges'))
+          .expect(200, '123456789', done)
+      })
+
+      it('should ignore Rage request header', function (done) {
+        request(createApp(fixtures, { 'acceptRanges': false }))
+          .get('/nums.txt')
+          .set('Range', 'bytes=0-3')
+          .expect(utils.shouldNotHaveHeader('Accept-Ranges'))
+          .expect(utils.shouldNotHaveHeader('Content-Range'))
+          .expect(200, '123456789', done)
+      })
+    })
+
+    describe('when true', function () {
+      it('should include Accept-Ranges', function (done) {
+        request(createApp(fixtures, { 'acceptRanges': true }))
+          .get('/nums.txt')
+          .expect('Accept-Ranges', 'bytes')
+          .expect(200, '123456789', done)
+      })
+
+      it('should obey Rage request header', function (done) {
+        request(createApp(fixtures, { 'acceptRanges': true }))
+          .get('/nums.txt')
+          .set('Range', 'bytes=0-3')
+          .expect('Accept-Ranges', 'bytes')
+          .expect('Content-Range', 'bytes 0-3/9')
+          .expect(206, '1234', done)
+      })
+    })
+  })
+
+  describe('cacheControl', function () {
+    describe('when false', function () {
+      it('should not include Cache-Control', function (done) {
+        request(createApp(fixtures, { 'cacheControl': false }))
+          .get('/nums.txt')
+          .expect(utils.shouldNotHaveHeader('Cache-Control'))
+          .expect(200, '123456789', done)
+      })
+
+      it('should ignore maxAge', function (done) {
+        request(createApp(fixtures, { 'cacheControl': false, 'maxAge': 12000 }))
+          .get('/nums.txt')
+          .expect(utils.shouldNotHaveHeader('Cache-Control'))
+          .expect(200, '123456789', done)
+      })
+    })
+
+    describe('when true', function () {
+      it('should include Cache-Control', function (done) {
+        request(createApp(fixtures, { 'cacheControl': true }))
+          .get('/nums.txt')
+          .expect('Cache-Control', 'public, max-age=0')
+          .expect(200, '123456789', done)
+      })
+    })
+  })
+
+  describe('extensions', function () {
+    it('should be not be enabled by default', function (done) {
+      request(createApp(fixtures))
+        .get('/todo')
+        .expect(404, done)
+    })
+
+    it('should be configurable', function (done) {
+      request(createApp(fixtures, { 'extensions': 'txt' }))
+        .get('/todo')
+        .expect(200, '- groceries', done)
+    })
+
+    it('should support disabling extensions', function (done) {
+      request(createApp(fixtures, { 'extensions': false }))
+        .get('/todo')
+        .expect(404, done)
+    })
+
+    it('should support fallbacks', function (done) {
+      request(createApp(fixtures, { 'extensions': ['htm', 'html', 'txt'] }))
+        .get('/todo')
+        .expect(200, '<li>groceries</li>', done)
+    })
+
+    it('should 404 if nothing found', function (done) {
+      request(createApp(fixtures, { 'extensions': ['htm', 'html', 'txt'] }))
+        .get('/bob')
+        .expect(404, done)
+    })
+  })
+
+  describe('fallthrough', function () {
+    it('should default to true', function (done) {
+      request(createApp())
+        .get('/does-not-exist')
+        .expect(404, 'Not Found', done)
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp(fixtures, { 'fallthrough': true })
+      })
+
+      it('should fall-through when OPTIONS request', function (done) {
+        request(this.app)
+          .options('/todo.txt')
+          .expect(404, 'Not Found', done)
+      })
+
+      it('should fall-through when URL malformed', function (done) {
+        request(this.app)
+          .get('/%')
+          .expect(404, 'Not Found', done)
+      })
+
+      it('should fall-through when traversing past root', function (done) {
+        request(this.app)
+          .get('/users/../../todo.txt')
+          .expect(404, 'Not Found', done)
+      })
+
+      it('should fall-through when URL too long', function (done) {
+        var app = express()
+        var root = fixtures + Array(10000).join('/foobar')
+
+        app.use(express.static(root, { 'fallthrough': true }))
+        app.use(function (req, res, next) {
+          res.sendStatus(404)
+        })
+
+        request(app)
+          .get('/')
+          .expect(404, 'Not Found', done)
+      })
+
+      describe('with redirect: true', function () {
+        before(function () {
+          this.app = createApp(fixtures, { 'fallthrough': true, 'redirect': true })
+        })
+
+        it('should fall-through when directory', function (done) {
+          request(this.app)
+            .get('/pets/')
+            .expect(404, 'Not Found', done)
+        })
+
+        it('should redirect when directory without slash', function (done) {
+          request(this.app)
+            .get('/pets')
+            .expect(301, /Redirecting/, done)
+        })
+      })
+
+      describe('with redirect: false', function () {
+        before(function () {
+          this.app = createApp(fixtures, { 'fallthrough': true, 'redirect': false })
+        })
+
+        it('should fall-through when directory', function (done) {
+          request(this.app)
+            .get('/pets/')
+            .expect(404, 'Not Found', done)
+        })
+
+        it('should fall-through when directory without slash', function (done) {
+          request(this.app)
+            .get('/pets')
+            .expect(404, 'Not Found', done)
+        })
+      })
+    })
+
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp(fixtures, { 'fallthrough': false })
+      })
+
+      it('should 405 when OPTIONS request', function (done) {
+        request(this.app)
+          .options('/todo.txt')
+          .expect('Allow', 'GET, HEAD')
+          .expect(405, done)
+      })
+
+      it('should 400 when URL malformed', function (done) {
+        request(this.app)
+          .get('/%')
+          .expect(400, /BadRequestError/, done)
+      })
+
+      it('should 403 when traversing past root', function (done) {
+        request(this.app)
+          .get('/users/../../todo.txt')
+          .expect(403, /ForbiddenError/, done)
+      })
+
+      it('should 404 when URL too long', function (done) {
+        var app = express()
+        var root = fixtures + Array(10000).join('/foobar')
+
+        app.use(express.static(root, { 'fallthrough': false }))
+        app.use(function (req, res, next) {
+          res.sendStatus(404)
+        })
+
+        request(app)
+          .get('/')
+          .expect(404, /ENAMETOOLONG/, done)
+      })
+
+      describe('with redirect: true', function () {
+        before(function () {
+          this.app = createApp(fixtures, { 'fallthrough': false, 'redirect': true })
+        })
+
+        it('should 404 when directory', function (done) {
+          request(this.app)
+            .get('/pets/')
+            .expect(404, /NotFoundError|ENOENT/, done)
+        })
+
+        it('should redirect when directory without slash', function (done) {
+          request(this.app)
+            .get('/pets')
+            .expect(301, /Redirecting/, done)
+        })
+      })
+
+      describe('with redirect: false', function () {
+        before(function () {
+          this.app = createApp(fixtures, { 'fallthrough': false, 'redirect': false })
+        })
+
+        it('should 404 when directory', function (done) {
+          request(this.app)
+            .get('/pets/')
+            .expect(404, /NotFoundError|ENOENT/, done)
+        })
+
+        it('should 404 when directory without slash', function (done) {
+          request(this.app)
+            .get('/pets')
+            .expect(404, /NotFoundError|ENOENT/, done)
+        })
+      })
+    })
+  })
+
+  describe('hidden files', function () {
+    before(function () {
+      this.app = createApp(fixtures, { 'dotfiles': 'allow' })
+    })
+
+    it('should be served when dotfiles: "allow" is given', function (done) {
+      request(this.app)
+        .get('/.name')
+        .expect(200)
+        .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+        .end(done)
+    })
+  })
+
+  describe('immutable', function () {
+    it('should default to false', function (done) {
+      request(createApp(fixtures))
+        .get('/nums.txt')
+        .expect('Cache-Control', 'public, max-age=0', done)
+    })
+
+    it('should set immutable directive in Cache-Control', function (done) {
+      request(createApp(fixtures, { 'immutable': true, 'maxAge': '1h' }))
+        .get('/nums.txt')
+        .expect('Cache-Control', 'public, max-age=3600, immutable', done)
+    })
+  })
+
+  describe('lastModified', function () {
+    describe('when false', function () {
+      it('should not include Last-Modifed', function (done) {
+        request(createApp(fixtures, { 'lastModified': false }))
+          .get('/nums.txt')
+          .expect(utils.shouldNotHaveHeader('Last-Modified'))
+          .expect(200, '123456789', done)
+      })
+    })
+
+    describe('when true', function () {
+      it('should include Last-Modifed', function (done) {
+        request(createApp(fixtures, { 'lastModified': true }))
+          .get('/nums.txt')
+          .expect('Last-Modified', /^\w{3}, \d+ \w+ \d+ \d+:\d+:\d+ \w+$/)
+          .expect(200, '123456789', done)
+      })
+    })
+  })
+
+  describe('maxAge', function () {
+    it('should accept string', function (done) {
+      request(createApp(fixtures, { 'maxAge': '30d' }))
+        .get('/todo.txt')
+        .expect('cache-control', 'public, max-age=' + (60 * 60 * 24 * 30))
+        .expect(200, done)
+    })
+
+    it('should be reasonable when infinite', function (done) {
+      request(createApp(fixtures, { 'maxAge': Infinity }))
+        .get('/todo.txt')
+        .expect('cache-control', 'public, max-age=' + (60 * 60 * 24 * 365))
+        .expect(200, done)
+    })
+  })
+
+  describe('redirect', function () {
+    before(function () {
+      this.app = express()
+      this.app.use(function (req, res, next) {
+        req.originalUrl = req.url =
+          req.originalUrl.replace(/\/snow(\/|$)/, '/snow \u2603$1')
+        next()
+      })
+      this.app.use(express.static(fixtures))
+    })
+
+    it('should redirect directories', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect('Location', '/users/')
+        .expect(301, done)
+    })
+
+    it('should include HTML link', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect('Location', '/users/')
+        .expect(301, /<a href="\/users\/">/, done)
+    })
+
+    it('should redirect directories with query string', function (done) {
+      request(this.app)
+        .get('/users?name=john')
+        .expect('Location', '/users/?name=john')
+        .expect(301, done)
+    })
+
+    it('should not redirect to protocol-relative locations', function (done) {
+      request(this.app)
+        .get('//users')
+        .expect('Location', '/users/')
+        .expect(301, done)
+    })
+
+    it('should ensure redirect URL is properly encoded', function (done) {
+      request(this.app)
+        .get('/snow')
+        .expect('Location', '/snow%20%E2%98%83/')
+        .expect('Content-Type', /html/)
+        .expect(301, />Redirecting to <a href="\/snow%20%E2%98%83\/">\/snow%20%E2%98%83\/<\/a></, done)
+    })
+
+    it('should respond with default Content-Security-Policy', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect('Content-Security-Policy', "default-src 'self'")
+        .expect(301, done)
+    })
+
+    it('should not redirect incorrectly', function (done) {
+      request(this.app)
+        .get('/')
+        .expect(404, done)
+    })
+
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp(fixtures, { 'redirect': false })
+      })
+
+      it('should disable redirect', function (done) {
+        request(this.app)
+          .get('/users')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('setHeaders', function () {
+    before(function () {
+      this.app = express()
+      this.app.use(express.static(fixtures, { 'setHeaders': function (res) {
+        res.setHeader('x-custom', 'set')
+      } }))
+    })
+
+    it('should reject non-functions', function () {
+      assert.throws(express.static.bind(null, fixtures, { 'setHeaders': 3 }), /setHeaders.*function/)
+    })
+
+    it('should get called when sending file', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .expect('x-custom', 'set')
+        .expect(200, done)
+    })
+
+    it('should not get called on 404', function (done) {
+      request(this.app)
+        .get('/bogus')
+        .expect(utils.shouldNotHaveHeader('x-custom'))
+        .expect(404, done)
+    })
+
+    it('should not get called on redirect', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect(utils.shouldNotHaveHeader('x-custom'))
+        .expect(301, done)
+    })
+  })
+
+  describe('when traversing past root', function () {
+    before(function () {
+      this.app = createApp(fixtures, { 'fallthrough': false })
+    })
+
+    it('should catch urlencoded ../', function (done) {
+      request(this.app)
+        .get('/users/%2e%2e/%2e%2e/todo.txt')
+        .expect(403, done)
+    })
+
+    it('should not allow root path disclosure', function (done) {
+      request(this.app)
+        .get('/users/../../fixtures/todo.txt')
+        .expect(403, done)
+    })
+  })
+
+  describe('when request has "Range" header', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should support byte ranges', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=0-4')
+        .expect('12345', done)
+    })
+
+    it('should be inclusive', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=0-0')
+        .expect('1', done)
+    })
+
+    it('should set Content-Range', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=2-5')
+        .expect('Content-Range', 'bytes 2-5/9', done)
+    })
+
+    it('should support -n', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=-3')
+        .expect('789', done)
+    })
+
+    it('should support n-', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=3-')
+        .expect('456789', done)
+    })
+
+    it('should respond with 206 "Partial Content"', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=0-4')
+        .expect(206, done)
+    })
+
+    it('should set Content-Length to the # of octets transferred', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=2-3')
+        .expect('Content-Length', '2')
+        .expect(206, '34', done)
+    })
+
+    describe('when last-byte-pos of the range is greater than current length', function () {
+      it('is taken to be equal to one less than the current length', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'bytes=2-50')
+          .expect('Content-Range', 'bytes 2-8/9', done)
+      })
+
+      it('should adapt the Content-Length accordingly', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'bytes=2-50')
+          .expect('Content-Length', '7')
+          .expect(206, done)
+      })
+    })
+
+    describe('when the first- byte-pos of the range is greater than the current length', function () {
+      it('should respond with 416', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'bytes=9-50')
+          .expect(416, done)
+      })
+
+      it('should include a Content-Range header of complete length', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'bytes=9-50')
+          .expect('Content-Range', 'bytes */9')
+          .expect(416, done)
+      })
+    })
+
+    describe('when syntactically invalid', function () {
+      it('should respond with 200 and the entire contents', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'asdf')
+          .expect('123456789', done)
+      })
+    })
+  })
+
+  describe('when index at mount point', function () {
+    before(function () {
+      this.app = express()
+      this.app.use('/users', express.static(fixtures + '/users'))
+    })
+
+    it('should redirect correctly', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect('Location', '/users/')
+        .expect(301, done)
+    })
+  })
+
+  describe('when mounted', function () {
+    before(function () {
+      this.app = express()
+      this.app.use('/static', express.static(fixtures))
+    })
+
+    it('should redirect relative to the originalUrl', function (done) {
+      request(this.app)
+        .get('/static/users')
+        .expect('Location', '/static/users/')
+        .expect(301, done)
+    })
+
+    it('should not choke on auth-looking URL', function (done) {
+      request(this.app)
+        .get('//todo@txt')
+        .expect(404, done)
+    })
+  })
+
+  //
+  // NOTE: This is not a real part of the API, but
+  //       over time this has become something users
+  //       are doing, so this will prevent unseen
+  //       regressions around this use-case.
+  //
+  describe('when mounted "root" as a file', function () {
+    before(function () {
+      this.app = express()
+      this.app.use('/todo.txt', express.static(fixtures + '/todo.txt'))
+    })
+
+    it('should load the file when on trailing slash', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect(200, '- groceries', done)
+    })
+
+    it('should 404 when trailing slash', function (done) {
+      request(this.app)
+        .get('/todo.txt/')
+        .expect(404, done)
+    })
+  })
+
+  describe('when responding non-2xx or 304', function () {
+    it('should not alter the status', function (done) {
+      var app = express()
+
+      app.use(function (req, res, next) {
+        res.status(501)
+        next()
+      })
+      app.use(express.static(fixtures))
+
+      request(app)
+        .get('/todo.txt')
+        .expect(501, '- groceries', done)
+    })
+  })
+
+  describe('when index file serving disabled', function () {
+    before(function () {
+      this.app = express()
+      this.app.use('/static', express.static(fixtures, { 'index': false }))
+      this.app.use(function (req, res, next) {
+        res.sendStatus(404)
+      })
+    })
+
+    it('should next() on directory', function (done) {
+      request(this.app)
+        .get('/static/users/')
+        .expect(404, 'Not Found', done)
+    })
+
+    it('should redirect to trailing slash', function (done) {
+      request(this.app)
+        .get('/static/users')
+        .expect('Location', '/static/users/')
+        .expect(301, done)
+    })
+
+    it('should next() on mount point', function (done) {
+      request(this.app)
+        .get('/static/')
+        .expect(404, 'Not Found', done)
+    })
+
+    it('should redirect to trailing slash mount point', function (done) {
+      request(this.app)
+        .get('/static')
+        .expect('Location', '/static/')
+        .expect(301, done)
+    })
+  })
+})
+
+function createApp (dir, options, fn) {
+  var app = express()
+  var root = dir || fixtures
+
+  app.use(express.static(root, options))
+
+  app.use(function (req, res, next) {
+    res.sendStatus(404)
+  })
+
+  return app
+}
diff --git a/test/fixtures/empty.txt b/test/fixtures/empty.txt
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/test/fixtures/nums.txt b/test/fixtures/nums.txt
new file mode 100644
index 00000000000..e2e107ac61a
--- /dev/null
+++ b/test/fixtures/nums.txt
@@ -0,0 +1 @@
+123456789
\ No newline at end of file
diff --git a/test/fixtures/pets/names.txt b/test/fixtures/pets/names.txt
new file mode 100644
index 00000000000..91407a3e048
--- /dev/null
+++ b/test/fixtures/pets/names.txt
@@ -0,0 +1 @@
+tobi,loki
\ No newline at end of file
diff --git "a/test/fixtures/snow \342\230\203/.gitkeep" "b/test/fixtures/snow \342\230\203/.gitkeep"
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/test/fixtures/todo.html b/test/fixtures/todo.html
new file mode 100644
index 00000000000..e7af6d7998d
--- /dev/null
+++ b/test/fixtures/todo.html
@@ -0,0 +1 @@
+<li>groceries</li>
\ No newline at end of file
diff --git a/test/fixtures/todo.txt b/test/fixtures/todo.txt
new file mode 100644
index 00000000000..8c3539d9461
--- /dev/null
+++ b/test/fixtures/todo.txt
@@ -0,0 +1 @@
+- groceries
\ No newline at end of file
diff --git a/test/fixtures/users/index.html b/test/fixtures/users/index.html
new file mode 100644
index 00000000000..00a2db41f75
--- /dev/null
+++ b/test/fixtures/users/index.html
@@ -0,0 +1 @@
+<p>tobi, loki, jane</p>
\ No newline at end of file
diff --git a/test/fixtures/users/tobi.txt b/test/fixtures/users/tobi.txt
new file mode 100644
index 00000000000..9d9529d47d7
--- /dev/null
+++ b/test/fixtures/users/tobi.txt
@@ -0,0 +1 @@
+ferret
\ No newline at end of file
diff --git a/test/support/utils.js b/test/support/utils.js
index ec6b801bc09..579f042a0c2 100644
--- a/test/support/utils.js
+++ b/test/support/utils.js
@@ -3,14 +3,48 @@
  * Module dependencies.
  * @private
  */
+
 var assert = require('assert');
+var Buffer = require('safe-buffer').Buffer
 
 /**
  * Module exports.
  * @public
  */
+
+exports.shouldHaveBody = shouldHaveBody
+exports.shouldNotHaveBody = shouldNotHaveBody
 exports.shouldNotHaveHeader = shouldNotHaveHeader;
 
+/**
+ * Assert that a supertest response has a specific body.
+ *
+ * @param {Buffer} buf
+ * @returns {function}
+ */
+
+function shouldHaveBody (buf) {
+  return function (res) {
+    var body = !Buffer.isBuffer(res.body)
+      ? Buffer.from(res.text)
+      : res.body
+    assert.ok(body, 'response has body')
+    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
+  }
+}
+
+/**
+ * Assert that a supertest response does not have a body.
+ *
+ * @returns {function}
+ */
+
+function shouldNotHaveBody () {
+  return function (res) {
+    assert.ok(res.text === '' || res.text === undefined)
+  }
+}
+
 /**
  * Assert that a supertest response does not have a header.
  *

From 70a19472f1ec22642ea98baa5f76b5ba656e7235 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 May 2019 23:05:37 -0400
Subject: [PATCH 157/479] deps: send@0.17.0

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3c2b59a6e22..688efb690e9 100644
--- a/History.md
+++ b/History.md
@@ -21,6 +21,12 @@ unreleased
     - deps: ipaddr.js@1.9.0
   * deps: qs@6.7.0
     - Fix parsing array brackets after index
+  * deps: send@0.17.0
+    - deps: http-errors@~1.7.2
+    - deps: mime@1.6.0
+    - deps: ms@2.1.1
+    - deps: statuses@~1.5.0
+    - perf: remove redundant `path.normalize` call
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
diff --git a/package.json b/package.json
index b443c34c82e..53753369f7b 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "6.7.0",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
-    "send": "0.16.2",
+    "send": "0.17.0",
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",

From 60aacac1670f01857961fb7d765eb015efb0be5b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 May 2019 23:42:36 -0400
Subject: [PATCH 158/479] deps: serve-static@1.14.0

closes #3486
---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 688efb690e9..71db3e8ef7a 100644
--- a/History.md
+++ b/History.md
@@ -27,6 +27,9 @@ unreleased
     - deps: ms@2.1.1
     - deps: statuses@~1.5.0
     - perf: remove redundant `path.normalize` call
+  * deps: serve-static@1.14.0
+    - deps: parseurl@~1.3.3
+    - deps: send@0.17.0
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
diff --git a/package.json b/package.json
index 53753369f7b..ef83d58d116 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
     "send": "0.17.0",
-    "serve-static": "1.13.2",
+    "serve-static": "1.14.0",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",
     "type-is": "~1.6.18",

From 0bcdd88dd089c8da7f29e76e8f152a40ca0bcf69 Mon Sep 17 00:00:00 2001
From: Amit Zur <sendwithchibo@gmail.com>
Date: Wed, 8 Aug 2018 07:42:00 +0300
Subject: [PATCH 159/479] Add express.raw to parse bodies into Buffer

closes #3708
---
 History.md      | 1 +
 lib/express.js  | 1 +
 test/exports.js | 5 +++++
 3 files changed, 7 insertions(+)

diff --git a/History.md b/History.md
index 71db3e8ef7a..35259befeea 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add `express.raw` to parse bodies into `Buffer`
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
diff --git a/lib/express.js b/lib/express.js
index 594007b5b43..f618ccc125a 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -77,6 +77,7 @@ exports.Router = Router;
 
 exports.json = bodyParser.json
 exports.query = require('./middleware/query');
+exports.raw = bodyParser.raw
 exports.static = require('serve-static');
 exports.urlencoded = bodyParser.urlencoded
 
diff --git a/test/exports.js b/test/exports.js
index e5fb6f2a9cf..f43df44c34c 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -14,6 +14,11 @@ describe('exports', function(){
     assert.equal(express.json.length, 1)
   })
 
+  it('should expose raw middleware', function () {
+    assert.equal(typeof express.raw, 'function')
+    assert.equal(express.raw.length, 1)
+  })
+
   it('should expose static middleware', function () {
     assert.equal(typeof express.static, 'function')
     assert.equal(express.static.length, 2)

From 11192bd168c5996efe718664a3f4d8f77dbaa71b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 May 2019 00:58:08 -0400
Subject: [PATCH 160/479] tests: add express.raw test suite

---
 test/express.raw.js | 387 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 387 insertions(+)
 create mode 100644 test/express.raw.js

diff --git a/test/express.raw.js b/test/express.raw.js
new file mode 100644
index 00000000000..571c29ca9bc
--- /dev/null
+++ b/test/express.raw.js
@@ -0,0 +1,387 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var request = require('supertest')
+
+describe('express.raw()', function () {
+  before(function () {
+    this.app = createApp()
+  })
+
+  it('should parse application/octet-stream', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .send('the user is tobi')
+      .expect(200, { buf: '746865207573657220697320746f6269' }, done)
+  })
+
+  it('should 400 when invalid content-length', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.headers['content-length'] = '20' // bad length
+      next()
+    })
+
+    app.use(express.raw())
+
+    app.post('/', function (req, res) {
+      if (Buffer.isBuffer(req.body)) {
+        res.json({ buf: req.body.toString('hex') })
+      } else {
+        res.json(req.body)
+      }
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .send('stuff')
+      .expect(400, /content length/, done)
+  })
+
+  it('should handle Content-Length: 0', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .set('Content-Length', '0')
+      .expect(200, { buf: '' }, done)
+  })
+
+  it('should handle empty message-body', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .set('Transfer-Encoding', 'chunked')
+      .send('')
+      .expect(200, { buf: '' }, done)
+  })
+
+  it('should handle duplicated middleware', function (done) {
+    var app = express()
+
+    app.use(express.raw())
+    app.use(express.raw())
+
+    app.post('/', function (req, res) {
+      if (Buffer.isBuffer(req.body)) {
+        res.json({ buf: req.body.toString('hex') })
+      } else {
+        res.json(req.body)
+      }
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .send('the user is tobi')
+      .expect(200, { buf: '746865207573657220697320746f6269' }, done)
+  })
+
+  describe('with limit option', function () {
+    it('should 413 when over limit with Content-Length', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.set('Content-Length', '1028')
+      test.write(buf)
+      test.expect(413, done)
+    })
+
+    it('should 413 when over limit with chunked encoding', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.set('Transfer-Encoding', 'chunked')
+      test.write(buf)
+      test.expect(413, done)
+    })
+
+    it('should accept number of bytes', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var app = createApp({ limit: 1024 })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(buf)
+      test.expect(413, done)
+    })
+
+    it('should not change when options altered', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var options = { limit: '1kb' }
+      var app = createApp(options)
+
+      options.limit = '100kb'
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(buf)
+      test.expect(413, done)
+    })
+
+    it('should not hang response', function (done) {
+      var buf = Buffer.alloc(10240, '.')
+      var app = createApp({ limit: '8kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(413, done)
+    })
+  })
+
+  describe('with inflate option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ inflate: false })
+      })
+
+      it('should not accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/octet-stream')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+        test.expect(415, 'content encoding unsupported', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ inflate: true })
+      })
+
+      it('should accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/octet-stream')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+        test.expect(200, { buf: '6e616d653de8aeba' }, done)
+      })
+    })
+  })
+
+  describe('with type option', function () {
+    describe('when "application/vnd+octets"', function () {
+      before(function () {
+        this.app = createApp({ type: 'application/vnd+octets' })
+      })
+
+      it('should parse for custom type', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/vnd+octets')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should ignore standard type', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/octet-stream')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, '{}', done)
+      })
+    })
+
+    describe('when ["application/octet-stream", "application/vnd+octets"]', function () {
+      before(function () {
+        this.app = createApp({
+          type: ['application/octet-stream', 'application/vnd+octets']
+        })
+      })
+
+      it('should parse "application/octet-stream"', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/octet-stream')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should parse "application/vnd+octets"', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/vnd+octets')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should ignore "application/x-foo"', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/x-foo')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, '{}', done)
+      })
+    })
+
+    describe('when a function', function () {
+      it('should parse when truthy value returned', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return req.headers['content-type'] === 'application/vnd.octet'
+        }
+
+        var test = request(app).post('/')
+        test.set('Content-Type', 'application/vnd.octet')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should work without content-type', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return true
+        }
+
+        var test = request(app).post('/')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should not invoke without a body', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          throw new Error('oops!')
+        }
+
+        request(app)
+          .get('/')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('with verify option', function () {
+    it('should assert value is function', function () {
+      assert.throws(createApp.bind(null, { verify: 'lol' }),
+        /TypeError: option verify must be function/)
+    })
+
+    it('should error from verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x00) throw new Error('no leading null')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('000102', 'hex'))
+      test.expect(403, 'no leading null', done)
+    })
+
+    it('should allow custom codes', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x00) return
+        var err = new Error('no leading null')
+        err.status = 400
+        throw err
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('000102', 'hex'))
+      test.expect(400, 'no leading null', done)
+    })
+
+    it('should allow pass-through', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x00) throw new Error('no leading null')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('0102', 'hex'))
+      test.expect(200, { buf: '0102' }, done)
+    })
+  })
+
+  describe('charset', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should ignore charset', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/octet-stream; charset=utf-8')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, { buf: '6e616d6520697320e8aeba' }, done)
+    })
+  })
+
+  describe('encoding', function () {
+    before(function () {
+      this.app = createApp({ limit: '10kb' })
+    })
+
+    it('should parse without encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should support identity encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'identity')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should support gzip encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should support deflate encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'deflate')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('789ccb4bcc4db57db16e17001068042f', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should be case-insensitive', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'GZIP')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should fail on unknown encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'unsupported content encoding "nulls"', done)
+    })
+  })
+})
+
+function createApp (options) {
+  var app = express()
+
+  app.use(express.raw(options))
+
+  app.use(function (err, req, res, next) {
+    res.status(err.status || 500)
+    res.send(String(err[req.headers['x-error-property'] || 'message']))
+  })
+
+  app.post('/', function (req, res) {
+    if (Buffer.isBuffer(req.body)) {
+      res.json({ buf: req.body.toString('hex') })
+    } else {
+      res.json(req.body)
+    }
+  })
+
+  return app
+}

From 7f4e37f3ea0bf99287472dd72f48d12a3b3d0b71 Mon Sep 17 00:00:00 2001
From: Ilya Guterman <amfernusus@gmail.com>
Date: Mon, 23 Oct 2017 18:00:19 +0300
Subject: [PATCH 161/479] Add express.text to parse bodies into string

closes #3455
---
 History.md      | 1 +
 lib/express.js  | 1 +
 test/exports.js | 5 +++++
 3 files changed, 7 insertions(+)

diff --git a/History.md b/History.md
index 35259befeea..2410810d337 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add `express.raw` to parse bodies into `Buffer`
+  * Add `express.text` to parse bodies into string
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
diff --git a/lib/express.js b/lib/express.js
index f618ccc125a..d188a16db70 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -79,6 +79,7 @@ exports.json = bodyParser.json
 exports.query = require('./middleware/query');
 exports.raw = bodyParser.raw
 exports.static = require('serve-static');
+exports.text = bodyParser.text
 exports.urlencoded = bodyParser.urlencoded
 
 /**
diff --git a/test/exports.js b/test/exports.js
index f43df44c34c..7624a8c8641 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -24,6 +24,11 @@ describe('exports', function(){
     assert.equal(express.static.length, 2)
   })
 
+  it('should expose text middleware', function () {
+    assert.equal(typeof express.text, 'function')
+    assert.equal(express.text.length, 1)
+  })
+
   it('should expose urlencoded middleware', function () {
     assert.equal(typeof express.urlencoded, 'function')
     assert.equal(express.urlencoded.length, 1)

From bb5211fa1cdf6da767960c2a8aa97f8c8f31e9c5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 May 2019 23:39:45 -0400
Subject: [PATCH 162/479] tests: add express.text test suite

---
 test/express.text.js | 441 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 441 insertions(+)
 create mode 100644 test/express.text.js

diff --git a/test/express.text.js b/test/express.text.js
new file mode 100644
index 00000000000..7c92f90e5aa
--- /dev/null
+++ b/test/express.text.js
@@ -0,0 +1,441 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var request = require('supertest')
+
+describe('express.text()', function () {
+  before(function () {
+    this.app = createApp()
+  })
+
+  it('should parse text/plain', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .send('user is tobi')
+      .expect(200, '"user is tobi"', done)
+  })
+
+  it('should 400 when invalid content-length', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.headers['content-length'] = '20' // bad length
+      next()
+    })
+
+    app.use(express.text())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .send('user')
+      .expect(400, /content length/, done)
+  })
+
+  it('should handle Content-Length: 0', function (done) {
+    request(createApp({ limit: '1kb' }))
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .set('Content-Length', '0')
+      .expect(200, '""', done)
+  })
+
+  it('should handle empty message-body', function (done) {
+    request(createApp({ limit: '1kb' }))
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .set('Transfer-Encoding', 'chunked')
+      .send('')
+      .expect(200, '""', done)
+  })
+
+  it('should handle duplicated middleware', function (done) {
+    var app = express()
+
+    app.use(express.text())
+    app.use(express.text())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .send('user is tobi')
+      .expect(200, '"user is tobi"', done)
+  })
+
+  describe('with defaultCharset option', function () {
+    it('should change default charset', function (done) {
+      var app = createApp({ defaultCharset: 'koi8-r' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('6e616d6520697320cec5d4', 'hex'))
+      test.expect(200, '"name is нет"', done)
+    })
+
+    it('should honor content-type charset', function (done) {
+      var app = createApp({ defaultCharset: 'koi8-r' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain; charset=utf-8')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+  })
+
+  describe('with limit option', function () {
+    it('should 413 when over limit with Content-Length', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      request(createApp({ limit: '1kb' }))
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .set('Content-Length', '1028')
+        .send(buf.toString())
+        .expect(413, done)
+    })
+
+    it('should 413 when over limit with chunked encoding', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.set('Transfer-Encoding', 'chunked')
+      test.write(buf.toString())
+      test.expect(413, done)
+    })
+
+    it('should accept number of bytes', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      request(createApp({ limit: 1024 }))
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send(buf.toString())
+        .expect(413, done)
+    })
+
+    it('should not change when options altered', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var options = { limit: '1kb' }
+      var app = createApp(options)
+
+      options.limit = '100kb'
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send(buf.toString())
+        .expect(413, done)
+    })
+
+    it('should not hang response', function (done) {
+      var buf = Buffer.alloc(10240, '.')
+      var app = createApp({ limit: '8kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(413, done)
+    })
+  })
+
+  describe('with inflate option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ inflate: false })
+      })
+
+      it('should not accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'text/plain')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+        test.expect(415, 'content encoding unsupported', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ inflate: true })
+      })
+
+      it('should accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'text/plain')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+        test.expect(200, '"name is 论"', done)
+      })
+    })
+  })
+
+  describe('with type option', function () {
+    describe('when "text/html"', function () {
+      before(function () {
+        this.app = createApp({ type: 'text/html' })
+      })
+
+      it('should parse for custom type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/html')
+          .send('<b>tobi</b>')
+          .expect(200, '"<b>tobi</b>"', done)
+      })
+
+      it('should ignore standard type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/plain')
+          .send('user is tobi')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when ["text/html", "text/plain"]', function () {
+      before(function () {
+        this.app = createApp({ type: ['text/html', 'text/plain'] })
+      })
+
+      it('should parse "text/html"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/html')
+          .send('<b>tobi</b>')
+          .expect(200, '"<b>tobi</b>"', done)
+      })
+
+      it('should parse "text/plain"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/plain')
+          .send('tobi')
+          .expect(200, '"tobi"', done)
+      })
+
+      it('should ignore "text/xml"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/xml')
+          .send('<user>tobi</user>')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when a function', function () {
+      it('should parse when truthy value returned', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return req.headers['content-type'] === 'text/vnd.something'
+        }
+
+        request(app)
+          .post('/')
+          .set('Content-Type', 'text/vnd.something')
+          .send('user is tobi')
+          .expect(200, '"user is tobi"', done)
+      })
+
+      it('should work without content-type', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return true
+        }
+
+        var test = request(app).post('/')
+        test.write('user is tobi')
+        test.expect(200, '"user is tobi"', done)
+      })
+
+      it('should not invoke without a body', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          throw new Error('oops!')
+        }
+
+        request(app)
+          .get('/')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('with verify option', function () {
+    it('should assert value is function', function () {
+      assert.throws(createApp.bind(null, { verify: 'lol' }),
+        /TypeError: option verify must be function/)
+    })
+
+    it('should error from verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x20) throw new Error('no leading space')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send(' user is tobi')
+        .expect(403, 'no leading space', done)
+    })
+
+    it('should allow custom codes', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x20) return
+        var err = new Error('no leading space')
+        err.status = 400
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send(' user is tobi')
+        .expect(400, 'no leading space', done)
+    })
+
+    it('should allow pass-through', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x20) throw new Error('no leading space')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send('user is tobi')
+        .expect(200, '"user is tobi"', done)
+    })
+
+    it('should 415 on unknown charset prior to verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        throw new Error('unexpected verify call')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain; charset=x-bogus')
+      test.write(Buffer.from('00000000', 'hex'))
+      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describe('charset', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should parse utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain; charset=utf-8')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should parse codepage charsets', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain; charset=koi8-r')
+      test.write(Buffer.from('6e616d6520697320cec5d4', 'hex'))
+      test.expect(200, '"name is нет"', done)
+    })
+
+    it('should parse when content-length != char length', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain; charset=utf-8')
+      test.set('Content-Length', '11')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should default to utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should 415 on unknown charset', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain; charset=x-bogus')
+      test.write(Buffer.from('00000000', 'hex'))
+      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describe('encoding', function () {
+    before(function () {
+      this.app = createApp({ limit: '10kb' })
+    })
+
+    it('should parse without encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should support identity encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'identity')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should support gzip encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should support deflate encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'deflate')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('789ccb4bcc4d55c82c5678b16e17001a6f050e', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should be case-insensitive', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'GZIP')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should fail on unknown encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'unsupported content encoding "nulls"', done)
+    })
+  })
+})
+
+function createApp (options) {
+  var app = express()
+
+  app.use(express.text(options))
+
+  app.use(function (err, req, res, next) {
+    res.status(err.status || 500)
+    res.send(err.message)
+  })
+
+  app.post('/', function (req, res) {
+    res.json(req.body)
+  })
+
+  return app
+}

From 7b076bd8e1c428da4887856d34b813aba2732c19 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 May 2019 18:03:12 -0400
Subject: [PATCH 163/479] build: Node.js@6.17

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 36e7e75e568..b07c383bb18 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.14"
+  - "6.17"
   - "7.10"
   - "8.12"
   - "9.11"
diff --git a/appveyor.yml b/appveyor.yml
index 4006a5e51d9..f970f8a7174 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.9"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.14"
+    - nodejs_version: "6.17"
     - nodejs_version: "7.10"
     - nodejs_version: "8.12"
     - nodejs_version: "9.11"

From e91702872994523dbb9f7da1bf30854c5dfb834a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 May 2019 18:03:56 -0400
Subject: [PATCH 164/479] build: Node.js@8.16

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index b07c383bb18..457029de675 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.17"
   - "7.10"
-  - "8.12"
+  - "8.16"
   - "9.11"
   - "10.12"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index f970f8a7174..c2cd643e1cb 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,7 +9,7 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.17"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.12"
+    - nodejs_version: "8.16"
     - nodejs_version: "9.11"
     - nodejs_version: "10.12"
 cache:

From c754c8ad7b33a1d9ec6bec88bc44734c16c36167 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 May 2019 19:45:01 -0400
Subject: [PATCH 165/479] build: support Node.js 11.x

---
 .travis.yml  | 3 +--
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 457029de675..b55dc4ae52f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,10 +12,9 @@ node_js:
   - "8.16"
   - "9.11"
   - "10.12"
+  - "11.15"
 matrix:
   include:
-    - node_js: "11"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "12"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
diff --git a/appveyor.yml b/appveyor.yml
index c2cd643e1cb..82463dee7d1 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -12,6 +12,7 @@ environment:
     - nodejs_version: "8.16"
     - nodejs_version: "9.11"
     - nodejs_version: "10.12"
+    - nodejs_version: "11.15"
 cache:
   - node_modules
 install:

From bc07a41693f8c7e9bde2bfb4cd5390ad6e3b1337 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 May 2019 22:09:56 -0400
Subject: [PATCH 166/479] deps: finalhandler@~1.1.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2410810d337..9ddfe35b884 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,10 @@ unreleased
     - deps: raw-body@2.4.0
     - deps: type-is@~1.6.17
   * deps: content-disposition@0.5.3
+  * deps: finalhandler@~1.1.2
+    - Set stricter `Content-Security-Policy` header
+    - deps: parseurl@~1.3.3
+    - deps: statuses@~1.5.0
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
diff --git a/package.json b/package.json
index ef83d58d116..6f89e3369de 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "1.1.1",
+    "finalhandler": "~1.1.2",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 8267c4b72422e68654849a71bfb74141d77bb875 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 May 2019 23:49:13 -0400
Subject: [PATCH 167/479] deps: send@0.17.1

---
 History.md   | 4 +++-
 package.json | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 9ddfe35b884..312f4b96952 100644
--- a/History.md
+++ b/History.md
@@ -27,10 +27,12 @@ unreleased
     - deps: ipaddr.js@1.9.0
   * deps: qs@6.7.0
     - Fix parsing array brackets after index
-  * deps: send@0.17.0
+  * deps: send@0.17.1
+    - Set stricter CSP header in redirect & error responses
     - deps: http-errors@~1.7.2
     - deps: mime@1.6.0
     - deps: ms@2.1.1
+    - deps: range-parser@~1.2.1
     - deps: statuses@~1.5.0
     - perf: remove redundant `path.normalize` call
   * deps: serve-static@1.14.0
diff --git a/package.json b/package.json
index 6f89e3369de..34904ac0002 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "6.7.0",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
-    "send": "0.17.0",
+    "send": "0.17.1",
     "serve-static": "1.14.0",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",

From 88f9733ffa58ce89bd5a9b207f0c8b4c2965fec6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 11 May 2019 19:29:33 -0400
Subject: [PATCH 168/479] deps: serve-static@1.14.1

---
 History.md             | 5 +++--
 package.json           | 2 +-
 test/express.static.js | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 312f4b96952..b0685594a3b 100644
--- a/History.md
+++ b/History.md
@@ -35,9 +35,10 @@ unreleased
     - deps: range-parser@~1.2.1
     - deps: statuses@~1.5.0
     - perf: remove redundant `path.normalize` call
-  * deps: serve-static@1.14.0
+  * deps: serve-static@1.14.1
+    - Set stricter CSP header in redirect response
     - deps: parseurl@~1.3.3
-    - deps: send@0.17.0
+    - deps: send@0.17.1
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
diff --git a/package.json b/package.json
index 34904ac0002..3a6a00d153b 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
     "send": "0.17.1",
-    "serve-static": "1.14.0",
+    "serve-static": "1.14.1",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",
     "type-is": "~1.6.18",
diff --git a/test/express.static.js b/test/express.static.js
index 7c9852243e6..485ee4c0c10 100644
--- a/test/express.static.js
+++ b/test/express.static.js
@@ -513,7 +513,7 @@ describe('express.static()', function () {
     it('should respond with default Content-Security-Policy', function (done) {
       request(this.app)
         .get('/users')
-        .expect('Content-Security-Policy', "default-src 'self'")
+        .expect('Content-Security-Policy', "default-src 'none'")
         .expect(301, done)
     })
 

From da6f701317d154e47921139257ffcefb15d15ca7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 May 2019 22:01:06 -0400
Subject: [PATCH 169/479] deps: range-parser@~1.2.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b0685594a3b..ef9aec948c3 100644
--- a/History.md
+++ b/History.md
@@ -27,6 +27,7 @@ unreleased
     - deps: ipaddr.js@1.9.0
   * deps: qs@6.7.0
     - Fix parsing array brackets after index
+  * deps: range-parser@~1.2.1
   * deps: send@0.17.1
     - Set stricter CSP header in redirect & error responses
     - deps: http-errors@~1.7.2
diff --git a/package.json b/package.json
index 3a6a00d153b..c722e230776 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.5",
     "qs": "6.7.0",
-    "range-parser": "~1.2.0",
+    "range-parser": "~1.2.1",
     "safe-buffer": "5.1.2",
     "send": "0.17.1",
     "serve-static": "1.14.1",

From e502dde3c8c82ff107603f78d6cac9a33a699dd7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 May 2019 22:09:35 -0400
Subject: [PATCH 170/479] build: Node.js@10.15

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index b55dc4ae52f..4706b75982f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
   - "8.16"
   - "9.11"
-  - "10.12"
+  - "10.15"
   - "11.15"
 matrix:
   include:
diff --git a/appveyor.yml b/appveyor.yml
index 82463dee7d1..b222f6b7b75 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,7 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.16"
     - nodejs_version: "9.11"
-    - nodejs_version: "10.12"
+    - nodejs_version: "10.15"
     - nodejs_version: "11.15"
 cache:
   - node_modules

From 5266f3a5cb25fdd6846b76a727d601506791c4ce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 May 2019 22:15:36 -0400
Subject: [PATCH 171/479] build: test against Node.js 13.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 4706b75982f..73422a7aa6c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,6 +17,8 @@ matrix:
   include:
     - node_js: "12"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "13"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From b9ecb9afe336ad00eb6e2dbc055e838649fe784f Mon Sep 17 00:00:00 2001
From: huadong zuo <admin@zuohuadong.cn>
Date: Wed, 24 Apr 2019 19:44:09 +0800
Subject: [PATCH 172/479] build: support Node.js 12.x

closes #3946
---
 .travis.yml  | 3 +--
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 73422a7aa6c..7b11677ec87 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,10 +13,9 @@ node_js:
   - "9.11"
   - "10.15"
   - "11.15"
+  - "12.2"
 matrix:
   include:
-    - node_js: "12"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "13"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
diff --git a/appveyor.yml b/appveyor.yml
index b222f6b7b75..84476a597d7 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,6 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.15"
     - nodejs_version: "11.15"
+    - nodejs_version: "12.2"
 cache:
   - node_modules
 install:

From efcb17dcb21699ef685eff4455a9443f707a4901 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 09:55:26 -0400
Subject: [PATCH 173/479] deps: cookie@0.4.0

closes #3958
---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ef9aec948c3..da36866652c 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,8 @@ unreleased
     - deps: raw-body@2.4.0
     - deps: type-is@~1.6.17
   * deps: content-disposition@0.5.3
+  * deps: cookie@0.4.0
+    - Add `SameSite=None` support
   * deps: finalhandler@~1.1.2
     - Set stricter `Content-Security-Policy` header
     - deps: parseurl@~1.3.3
diff --git a/package.json b/package.json
index c722e230776..b8b0b19e9ff 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "body-parser": "1.19.0",
     "content-disposition": "0.5.3",
     "content-type": "~1.0.4",
-    "cookie": "0.3.1",
+    "cookie": "0.4.0",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~1.1.2",

From 94e48a16f273963dc37829352b7381e4e9222315 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 09:58:40 -0400
Subject: [PATCH 174/479] build: update example dependencies

---
 package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index b8b0b19e9ff..87b80ce33d2 100644
--- a/package.json
+++ b/package.json
@@ -60,12 +60,12 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "connect-redis": "3.4.0",
-    "cookie-parser": "~1.4.3",
-    "cookie-session": "1.3.2",
+    "connect-redis": "3.4.1",
+    "cookie-parser": "~1.4.4",
+    "cookie-session": "1.3.3",
     "ejs": "2.6.1",
     "eslint": "2.13.1",
-    "express-session": "1.15.6",
+    "express-session": "1.16.1",
     "hbs": "4.0.4",
     "istanbul": "0.4.5",
     "marked": "0.6.2",

From b8e50568af9c73ef1ade434e92c60d389868361d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 10:04:24 -0400
Subject: [PATCH 175/479] tests: ignore unreachable line

---
 lib/response.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/response.js b/lib/response.js
index c1514901c57..a4f10cbb2e1 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -1135,6 +1135,7 @@ function stringify (value, replacer, spaces, escape) {
           return '\\u003e'
         case 0x26:
           return '\\u0026'
+        /* istanbul ignore next: unreachable default */
         default:
           return c
       }

From 9dadca2c64ae717063b0e9071143065896ebb676 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 20:53:07 -0400
Subject: [PATCH 176/479] docs: remove Gratipay links

---
 Readme.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/Readme.md b/Readme.md
index 81d8d91615e..1f91297312b 100644
--- a/Readme.md
+++ b/Readme.md
@@ -153,7 +153,3 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
 [coveralls-image]: https://img.shields.io/coveralls/expressjs/express/master.svg
 [coveralls-url]: https://coveralls.io/r/expressjs/express?branch=master
-[gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg
-[gratipay-url-visionmedia]: https://gratipay.com/visionmedia/
-[gratipay-image-dougwilson]: https://img.shields.io/gratipay/dougwilson.svg
-[gratipay-url-dougwilson]: https://gratipay.com/dougwilson/

From 10c7756764fbe969b307b15a72fd074479c00f8d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 21:25:42 -0400
Subject: [PATCH 177/479] 4.17.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index da36866652c..cca851d2e0f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.17.0 / 2019-05-16
+===================
 
   * Add `express.raw` to parse bodies into `Buffer`
   * Add `express.text` to parse bodies into string
diff --git a/package.json b/package.json
index 87b80ce33d2..726af2f6bab 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.4",
+  "version": "4.17.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From eed05a1464485edc5154ce989a679ba602f11ed8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 24 May 2019 23:20:52 -0400
Subject: [PATCH 178/479] build: Node.js@12.3

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 7b11677ec87..c3ebc583d6b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "9.11"
   - "10.15"
   - "11.15"
-  - "12.2"
+  - "12.3"
 matrix:
   include:
     - node_js: "13"
diff --git a/appveyor.yml b/appveyor.yml
index 84476a597d7..24434cd14af 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,7 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.15"
     - nodejs_version: "11.15"
-    - nodejs_version: "12.2"
+    - nodejs_version: "12.3"
 cache:
   - node_modules
 install:

From 0a48e18056865364b2461b2ece7ccb2d1075d3c9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 25 May 2019 18:15:13 -0400
Subject: [PATCH 179/479] Revert "Improve error message for null/undefined to
 res.status"

fixes #3968
---
 History.md         |  5 +++++
 lib/response.js    |  4 ----
 test/res.status.js | 32 --------------------------------
 3 files changed, 5 insertions(+), 36 deletions(-)

diff --git a/History.md b/History.md
index cca851d2e0f..631e0e5170b 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Revert "Improve error message for `null`/`undefined` to `res.status`"
+
 4.17.0 / 2019-05-16
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index a4f10cbb2e1..c9f08cd54f4 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -64,10 +64,6 @@ var charsetRegExp = /;\s*charset\s*=/;
  */
 
 res.status = function status(code) {
-  if (code === undefined || code === null) {
-    throw new TypeError('code argument is required to res.status')
-  }
-
   this.statusCode = code;
   return this;
 };
diff --git a/test/res.status.js b/test/res.status.js
index 3f928ec0b0b..8c173a645c5 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -16,37 +16,5 @@ describe('res', function(){
       .expect('Created')
       .expect(201, done);
     })
-
-    describe('when code is undefined', function () {
-      it('should throw a TypeError', function (done) {
-        var app = express()
-
-        app.use(function (req, res) {
-          res.status(undefined).send('OK')
-        })
-
-        request(app)
-        .get('/')
-        .expect(500)
-        .expect(/TypeError: code argument is required to res.status/)
-        .end(done)
-      })
-    })
-
-    describe('when code is null', function () {
-      it('should throw a TypeError', function (done) {
-        var app = express()
-
-        app.use(function (req, res) {
-          res.status(null).send('OK')
-        })
-
-        request(app)
-        .get('/')
-        .expect(500)
-        .expect(/TypeError: code argument is required to res.status/)
-        .end(done)
-      })
-    })
   })
 })

From e1b45ebd050b6f06aa38cda5aaf0c21708b0c71e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 May 2019 00:24:55 -0400
Subject: [PATCH 180/479] 4.17.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 631e0e5170b..6e62a6ddb85 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.17.1 / 2019-05-25
+===================
 
   * Revert "Improve error message for `null`/`undefined` to `res.status`"
 
diff --git a/package.json b/package.json
index 726af2f6bab..2979d57a22f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.17.0",
+  "version": "4.17.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From dfa7b80642d3c30d911feeca9a460d1802d34a72 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Aug 2019 22:03:22 -0400
Subject: [PATCH 181/479] build: Node.js@10.16

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index c3ebc583d6b..6e144c24636 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
   - "8.16"
   - "9.11"
-  - "10.15"
+  - "10.16"
   - "11.15"
   - "12.3"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index 24434cd14af..3d775eb2112 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,7 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.16"
     - nodejs_version: "9.11"
-    - nodejs_version: "10.15"
+    - nodejs_version: "10.16"
     - nodejs_version: "11.15"
     - nodejs_version: "12.3"
 cache:

From 6506fb578ce06081f82c13fafafe35dfca7d9c86 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Aug 2019 22:09:45 -0400
Subject: [PATCH 182/479] build: Node.js@12.7

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 6e144c24636..75907eed535 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "9.11"
   - "10.16"
   - "11.15"
-  - "12.3"
+  - "12.7"
 matrix:
   include:
     - node_js: "13"
diff --git a/appveyor.yml b/appveyor.yml
index 3d775eb2112..1675129d508 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,7 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.16"
     - nodejs_version: "11.15"
-    - nodejs_version: "12.3"
+    - nodejs_version: "12.7"
 cache:
   - node_modules
 install:

From 4efb49866df68a209808ac896ecbd6e53ae66ec7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Aug 2019 22:23:09 -0400
Subject: [PATCH 183/479] build: mocha@6.2.0

---
 .travis.yml  | 7 +++++--
 appveyor.yml | 7 +++++--
 package.json | 2 +-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 75907eed535..6827cf0c3ee 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -37,9 +37,12 @@ before_install:
   # Setup Node.js version-specific dependencies
   - |
     # mocha for testing
-    # - use 3.x for Node.js < 6
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
+    # - use 3.x for Node.js < 4
+    # - use 5.x for Node.js < 6
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
       npm install --silent --save-dev mocha@3.5.3
+    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
+      npm install --silent --save-dev mocha@5.2.0
     fi
   - |
     # supertest for http calls
diff --git a/appveyor.yml b/appveyor.yml
index 1675129d508..16e9a084bbe 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -32,9 +32,12 @@ install:
   # Setup Node.js version-specific dependencies
   - ps: |
       # mocha for testing
-      # - use 3.x for Node.js < 6
-      if ($env:nodejs_version.split(".")[0] -lt 6) {
+      # - use 3.x for Node.js < 4
+      # - use 5.x for Node.js < 6
+      if ($env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev mocha@3.5.3
+      } elseif ($env:nodejs_version.split(".")[0] -lt 6) {
+        npm install --silent --save-dev mocha@5.2.0
       }
   - ps: |
       # supertest for http calls
diff --git a/package.json b/package.json
index 2979d57a22f..3b26c45471f 100644
--- a/package.json
+++ b/package.json
@@ -70,7 +70,7 @@
     "istanbul": "0.4.5",
     "marked": "0.6.2",
     "method-override": "3.0.0",
-    "mocha": "5.2.0",
+    "mocha": "6.2.0",
     "morgan": "1.9.1",
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",

From 741e3f81af6264e4d67a59528a64b40f96ca5911 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Nov 2019 22:04:12 -0500
Subject: [PATCH 184/479] build: Node.js@10.17

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 6827cf0c3ee..878ee8377f9 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
   - "8.16"
   - "9.11"
-  - "10.16"
+  - "10.17"
   - "11.15"
   - "12.7"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index 16e9a084bbe..a89d339f7ae 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,7 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.16"
     - nodejs_version: "9.11"
-    - nodejs_version: "10.16"
+    - nodejs_version: "10.17"
     - nodejs_version: "11.15"
     - nodejs_version: "12.7"
 cache:

From 866ffd67d785f88616b7444871c05995a21cff0e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Nov 2019 22:09:43 -0500
Subject: [PATCH 185/479] build: Node.js@12.13

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 878ee8377f9..fbbfbcdb7d1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "9.11"
   - "10.17"
   - "11.15"
-  - "12.7"
+  - "12.13"
 matrix:
   include:
     - node_js: "13"
diff --git a/appveyor.yml b/appveyor.yml
index a89d339f7ae..01e3bdd5683 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,7 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.17"
     - nodejs_version: "11.15"
-    - nodejs_version: "12.7"
+    - nodejs_version: "12.13"
 cache:
   - node_modules
 install:

From 668d029a14acfb031652c54bf32f705d2dde64ee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Nov 2019 22:15:49 -0500
Subject: [PATCH 186/479] build: mocha@6.2.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3b26c45471f..ac9152b67d1 100644
--- a/package.json
+++ b/package.json
@@ -70,7 +70,7 @@
     "istanbul": "0.4.5",
     "marked": "0.6.2",
     "method-override": "3.0.0",
-    "mocha": "6.2.0",
+    "mocha": "6.2.2",
     "morgan": "1.9.1",
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",

From 95735a6fccd165fb6113daae9259ca26efc52171 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Nov 2019 22:21:57 -0500
Subject: [PATCH 187/479] build: supertest@3.4.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ac9152b67d1..65ab7da19e5 100644
--- a/package.json
+++ b/package.json
@@ -75,7 +75,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "3.3.0",
+    "supertest": "3.4.2",
     "vhost": "~3.0.2"
   },
   "engines": {

From e757fa003938dddc19f1ed3c447fffe1062f1508 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Jan 2020 18:30:57 -0500
Subject: [PATCH 188/479] build: Node.js@8.17

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index fbbfbcdb7d1..8c4529fe06b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.17"
   - "7.10"
-  - "8.16"
+  - "8.17"
   - "9.11"
   - "10.17"
   - "11.15"

From 55831bbd08736b8424d26a8ee22039e06a8816aa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Jan 2020 18:37:52 -0500
Subject: [PATCH 189/479] build: Node.js@10.18

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 8c4529fe06b..9ab31558d86 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.17"
+  - "10.18"
   - "11.15"
   - "12.13"
 matrix:

From f1e8a877f4f70dbf0a12e2471671be68e35e31d8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Jan 2020 18:40:28 -0500
Subject: [PATCH 190/479] build: Node.js@12.14

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 9ab31558d86..8d7cf6c22da 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "9.11"
   - "10.18"
   - "11.15"
-  - "12.13"
+  - "12.14"
 matrix:
   include:
     - node_js: "13"

From f0cbdeadf695d4e5dc1332666e864ce82845a555 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Jan 2020 18:58:52 -0500
Subject: [PATCH 191/479] build: mocha@7.0.0

---
 .travis.yml  | 3 +++
 appveyor.yml | 3 +++
 package.json | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 8d7cf6c22da..8bda1d8d9f8 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -39,10 +39,13 @@ before_install:
     # mocha for testing
     # - use 3.x for Node.js < 4
     # - use 5.x for Node.js < 6
+    # - use 6.x for Node.js < 8
     if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
       npm install --silent --save-dev mocha@3.5.3
     elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
       npm install --silent --save-dev mocha@5.2.0
+    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 8 ]]; then
+      npm install --silent --save-dev mocha@6.2.2
     fi
   - |
     # supertest for http calls
diff --git a/appveyor.yml b/appveyor.yml
index 01e3bdd5683..b95b8e2d5ac 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -34,10 +34,13 @@ install:
       # mocha for testing
       # - use 3.x for Node.js < 4
       # - use 5.x for Node.js < 6
+      # - use 6.x for Node.js < 8
       if ($env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev mocha@3.5.3
       } elseif ($env:nodejs_version.split(".")[0] -lt 6) {
         npm install --silent --save-dev mocha@5.2.0
+      } elseif ($env:nodejs_version.split(".")[0] -lt 8) {
+        npm install --silent --save-dev mocha@6.2.2
       }
   - ps: |
       # supertest for http calls
diff --git a/package.json b/package.json
index 65ab7da19e5..a988bb5fc0a 100644
--- a/package.json
+++ b/package.json
@@ -70,7 +70,7 @@
     "istanbul": "0.4.5",
     "marked": "0.6.2",
     "method-override": "3.0.0",
-    "mocha": "6.2.2",
+    "mocha": "7.0.0",
     "morgan": "1.9.1",
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",

From 87bc4ef7638c38abf6c2bca10a07a0b1e4fd4a60 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 11 Feb 2020 23:10:15 -0500
Subject: [PATCH 192/479] build: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index a988bb5fc0a..725e3ff0538 100644
--- a/package.json
+++ b/package.json
@@ -60,15 +60,15 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "connect-redis": "3.4.1",
+    "connect-redis": "3.4.2",
     "cookie-parser": "~1.4.4",
     "cookie-session": "1.3.3",
-    "ejs": "2.6.1",
+    "ejs": "2.7.2",
     "eslint": "2.13.1",
-    "express-session": "1.16.1",
-    "hbs": "4.0.4",
+    "express-session": "1.17.0",
+    "hbs": "4.1.0",
     "istanbul": "0.4.5",
-    "marked": "0.6.2",
+    "marked": "0.7.0",
     "method-override": "3.0.0",
     "mocha": "7.0.0",
     "morgan": "1.9.1",

From 872aa4741c95c2ba15e0dd40cd54ed6eb6c83e3e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Feb 2020 00:27:51 -0500
Subject: [PATCH 193/479] build: Node.js@10.19

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 8bda1d8d9f8..78cdba19380 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.18"
+  - "10.19"
   - "11.15"
   - "12.14"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index b95b8e2d5ac..1b579dd8292 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,7 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.16"
     - nodejs_version: "9.11"
-    - nodejs_version: "10.17"
+    - nodejs_version: "10.19"
     - nodejs_version: "11.15"
     - nodejs_version: "12.13"
 cache:

From 22d5b7ed108e2e67f694c126278a87bd28f89fe7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Feb 2020 00:32:14 -0500
Subject: [PATCH 194/479] build: Node.js@12.16

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 78cdba19380..7178dd4bf20 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "9.11"
   - "10.19"
   - "11.15"
-  - "12.14"
+  - "12.16"
 matrix:
   include:
     - node_js: "13"
diff --git a/appveyor.yml b/appveyor.yml
index 1b579dd8292..9d3b80fafae 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,7 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.19"
     - nodejs_version: "11.15"
-    - nodejs_version: "12.13"
+    - nodejs_version: "12.16"
 cache:
   - node_modules
 install:

From d967675852b06384c8ebfc065430a8e215fc08f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Feb 2020 00:49:36 -0500
Subject: [PATCH 195/479] build: mocha@7.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 725e3ff0538..2110419476e 100644
--- a/package.json
+++ b/package.json
@@ -70,7 +70,7 @@
     "istanbul": "0.4.5",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "7.0.0",
+    "mocha": "7.0.1",
     "morgan": "1.9.1",
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",

From 2d519077ea6c7c52a16098c7cf6d8d667a863c7b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2020 20:31:10 -0400
Subject: [PATCH 196/479] build: supertest@4.0.2

---
 .travis.yml  | 3 +++
 appveyor.yml | 3 +++
 package.json | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 7178dd4bf20..6cae565f990 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -50,8 +50,11 @@ before_install:
   - |
     # supertest for http calls
     # - use 2.0.0 for Node.js < 4
+    # - use 3.4.2 for Node.js < 6
     if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
       npm install --silent --save-dev supertest@2.0.0
+    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
+      npm install --silent --save-dev supertest@3.4.2
     fi
   # Update Node.js modules
   - |
diff --git a/appveyor.yml b/appveyor.yml
index 9d3b80fafae..94d25b3d535 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -45,8 +45,11 @@ install:
   - ps: |
       # supertest for http calls
       # - use 2.0.0 for Node.js < 4
+      # - use 3.4.2 for Node.js < 6
       if ($env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev supertest@2.0.0
+      } elseif ($env:nodejs_version.split(".")[0] -lt 6) {
+        npm install --silent --save-dev supertest@3.4.2
       }
   # Update Node.js modules
   - ps: |
diff --git a/package.json b/package.json
index 2110419476e..6296ac68a33 100644
--- a/package.json
+++ b/package.json
@@ -75,7 +75,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "3.4.2",
+    "supertest": "4.0.2",
     "vhost": "~3.0.2"
   },
   "engines": {

From 65aff94ec62b9f550aa7fb82cd8a1dd7b7da0bfc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2020 20:37:16 -0400
Subject: [PATCH 197/479] build: remove deprecated Travis CI directive

---
 .travis.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6cae565f990..37735595818 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -21,7 +21,6 @@ matrix:
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
-sudo: false
 cache:
   directories:
     - node_modules

From 47c1d2a8168a4e6b060f32c1d15ba8ed2f52a99b Mon Sep 17 00:00:00 2001
From: Chang Wang <cheapsteak@gmail.com>
Date: Thu, 1 Mar 2018 19:37:45 -0500
Subject: [PATCH 198/479] docs: point npm downloads badge to npm charts of
 express

closes #3579
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 1f91297312b..dae3ddb9ce9 100644
--- a/Readme.md
+++ b/Readme.md
@@ -146,7 +146,7 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 [npm-image]: https://img.shields.io/npm/v/express.svg
 [npm-url]: https://npmjs.org/package/express
 [downloads-image]: https://img.shields.io/npm/dm/express.svg
-[downloads-url]: https://npmjs.org/package/express
+[downloads-url]: https://npmcharts.com/compare/express?minimal=true
 [travis-image]: https://img.shields.io/travis/expressjs/express/master.svg?label=linux
 [travis-url]: https://travis-ci.org/expressjs/express
 [appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/express/master.svg?label=windows

From 4b4fa26298c3ee9eb7385cc04a1f33f670fd82bb Mon Sep 17 00:00:00 2001
From: yanokenken <yanoken0822@gmail.com>
Date: Sun, 26 May 2019 00:24:55 -0400
Subject: [PATCH 199/479] docs: add npm init hint to install section

---
 Readme.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Readme.md b/Readme.md
index dae3ddb9ce9..9b15b440d72 100644
--- a/Readme.md
+++ b/Readme.md
@@ -27,6 +27,9 @@ This is a [Node.js](https://nodejs.org/en/) module available through the
 Before installing, [download and install Node.js](https://nodejs.org/en/download/).
 Node.js 0.10 or higher is required.
 
+If this is a brand new project, make sure to create a `package.json` first with
+the [`npm init` command](https://docs.npmjs.com/creating-a-package-json-file).
+
 Installation is done using the
 [`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
 

From 3f1dcb96e0ad0145b47a4b1e37bfbbfa6abaf602 Mon Sep 17 00:00:00 2001
From: Aditya Srivastava <adisrivas98@gmail.com>
Date: Tue, 22 Jan 2019 17:44:37 +0530
Subject: [PATCH 200/479] examples: add viewport and charset where missing

closes #3860
---
 examples/auth/views/head.ejs                 | 2 ++
 examples/ejs/views/header.html               | 1 +
 examples/error-pages/views/error_header.ejs  | 2 ++
 examples/error-pages/views/index.ejs         | 2 ++
 examples/mvc/controllers/pet/views/edit.ejs  | 2 ++
 examples/mvc/controllers/pet/views/show.ejs  | 2 ++
 examples/mvc/controllers/user/views/edit.hbs | 2 ++
 examples/mvc/controllers/user/views/list.hbs | 2 ++
 examples/mvc/controllers/user/views/show.hbs | 2 ++
 examples/mvc/views/404.ejs                   | 1 +
 examples/mvc/views/5xx.ejs                   | 1 +
 examples/route-separation/views/header.ejs   | 1 +
 examples/search/public/index.html            | 1 +
 examples/view-locals/views/index.ejs         | 1 +
 14 files changed, 22 insertions(+)

diff --git a/examples/auth/views/head.ejs b/examples/auth/views/head.ejs
index 0a919f49296..65386267d0d 100644
--- a/examples/auth/views/head.ejs
+++ b/examples/auth/views/head.ejs
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
   <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
     <title><%= title %></title>
     <style>
       body {
diff --git a/examples/ejs/views/header.html b/examples/ejs/views/header.html
index 4396bc444fa..c642a15f639 100644
--- a/examples/ejs/views/header.html
+++ b/examples/ejs/views/header.html
@@ -2,6 +2,7 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
   <title><%= title %></title>
   <link rel="stylesheet" href="/stylesheets/style.css">
 </head>
diff --git a/examples/error-pages/views/error_header.ejs b/examples/error-pages/views/error_header.ejs
index 6d541dd9f5c..b2451ab3241 100644
--- a/examples/error-pages/views/error_header.ejs
+++ b/examples/error-pages/views/error_header.ejs
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Error</title>
 </head>
 
diff --git a/examples/error-pages/views/index.ejs b/examples/error-pages/views/index.ejs
index 04a1a7847b9..ae8c92820a7 100644
--- a/examples/error-pages/views/index.ejs
+++ b/examples/error-pages/views/index.ejs
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Custom Pages Example</title>
 </head>
 
diff --git a/examples/mvc/controllers/pet/views/edit.ejs b/examples/mvc/controllers/pet/views/edit.ejs
index fc697c25500..655666e0109 100644
--- a/examples/mvc/controllers/pet/views/edit.ejs
+++ b/examples/mvc/controllers/pet/views/edit.ejs
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
 <link rel="stylesheet" href="/style.css">
 <title>Edit <%= pet.name %></title>
 </head>
diff --git a/examples/mvc/controllers/pet/views/show.ejs b/examples/mvc/controllers/pet/views/show.ejs
index 2ec7b0bf063..7e1e338e7d8 100644
--- a/examples/mvc/controllers/pet/views/show.ejs
+++ b/examples/mvc/controllers/pet/views/show.ejs
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
 <link rel="stylesheet" href="/style.css">
 <title><%= pet.name %></title>
 </head>
diff --git a/examples/mvc/controllers/user/views/edit.hbs b/examples/mvc/controllers/user/views/edit.hbs
index d356f5ee7f3..2be7ddc4a94 100644
--- a/examples/mvc/controllers/user/views/edit.hbs
+++ b/examples/mvc/controllers/user/views/edit.hbs
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
   <link rel="stylesheet" href="/style.css">
   <title>Edit {{user.name}}</title>
 </head>
diff --git a/examples/mvc/controllers/user/views/list.hbs b/examples/mvc/controllers/user/views/list.hbs
index 191867de3ff..448c66f8c78 100644
--- a/examples/mvc/controllers/user/views/list.hbs
+++ b/examples/mvc/controllers/user/views/list.hbs
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
   <link rel="stylesheet" href="/style.css">
   <title>Users</title>
 </head>
diff --git a/examples/mvc/controllers/user/views/show.hbs b/examples/mvc/controllers/user/views/show.hbs
index f064cf54f1f..f3fccfe046b 100644
--- a/examples/mvc/controllers/user/views/show.hbs
+++ b/examples/mvc/controllers/user/views/show.hbs
@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
   <link rel="stylesheet" href="/style.css">
   <title>{{user.name}}</title>
 </head>
diff --git a/examples/mvc/views/404.ejs b/examples/mvc/views/404.ejs
index 18d7e4afe3a..21a86f8a653 100644
--- a/examples/mvc/views/404.ejs
+++ b/examples/mvc/views/404.ejs
@@ -2,6 +2,7 @@
 <html>
   <head>
     <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
     <title>Not Found</title>
     <link rel="stylesheet" href="/style.css">
   </head>
diff --git a/examples/mvc/views/5xx.ejs b/examples/mvc/views/5xx.ejs
index ea0f246ddfd..190f580543a 100644
--- a/examples/mvc/views/5xx.ejs
+++ b/examples/mvc/views/5xx.ejs
@@ -2,6 +2,7 @@
 <html>
   <head>
     <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
     <title>Internal Server Error</title>
     <link rel="stylesheet" href="/style.css">
   </head>
diff --git a/examples/route-separation/views/header.ejs b/examples/route-separation/views/header.ejs
index 141f114ddba..4300325e0a1 100644
--- a/examples/route-separation/views/header.ejs
+++ b/examples/route-separation/views/header.ejs
@@ -2,6 +2,7 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
   <title><%= title %></title>
   <link rel="stylesheet" href="/style.css">
 </head>
diff --git a/examples/search/public/index.html b/examples/search/public/index.html
index 4a5540fdf3a..f67063c502c 100644
--- a/examples/search/public/index.html
+++ b/examples/search/public/index.html
@@ -2,6 +2,7 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
   <title>Search example</title>
   <style type="text/css">
     body {
diff --git a/examples/view-locals/views/index.ejs b/examples/view-locals/views/index.ejs
index 1cbfc40bc00..287f34bc284 100644
--- a/examples/view-locals/views/index.ejs
+++ b/examples/view-locals/views/index.ejs
@@ -2,6 +2,7 @@
 <html>
   <head>
     <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
     <title><%= title %></title>
     <style media="screen">
       body {

From 323a38965afc586e7d02fb6a557b93719e817dd9 Mon Sep 17 00:00:00 2001
From: KoyamaSohei <koyamaso0309@gmail.com>
Date: Fri, 13 Dec 2019 14:41:03 +0900
Subject: [PATCH 201/479] examples: properly escape user input in route-map

fixes #3992
closes #4119
---
 examples/route-map/index.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/examples/route-map/index.js b/examples/route-map/index.js
index f2b192ac1d9..e7adf5fcb4b 100644
--- a/examples/route-map/index.js
+++ b/examples/route-map/index.js
@@ -2,6 +2,7 @@
  * Module dependencies.
  */
 
+var escapeHtml = require('escape-html')
 var express = require('../../lib/express');
 
 var verbose = process.env.NODE_ENV !== 'test'
@@ -31,7 +32,7 @@ var users = {
   },
 
   get: function(req, res){
-    res.send('user ' + req.params.uid);
+    res.send('user ' +  escapeHtml(req.params.uid))
   },
 
   delete: function(req, res){
@@ -41,11 +42,11 @@ var users = {
 
 var pets = {
   list: function(req, res){
-    res.send('user ' + req.params.uid + '\'s pets');
+    res.send('user ' + escapeHtml(req.params.uid) + '\'s pets')
   },
 
   delete: function(req, res){
-    res.send('delete ' + req.params.uid + '\'s pet ' + req.params.pid);
+    res.send('delete ' + escapeHtml(req.params.uid) + '\'s pet ' + escapeHtml(req.params.pid))
   }
 };
 

From 922e9a46158577d19ef704fe7a6f78102fd2278c Mon Sep 17 00:00:00 2001
From: Manuel Baesler <baslr@users.noreply.github.com>
Date: Fri, 15 Nov 2019 20:28:26 +0100
Subject: [PATCH 202/479] build: add http keyword for npm search

closes #4102
---
 package.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package.json b/package.json
index 6296ac68a33..9b841872f4a 100644
--- a/package.json
+++ b/package.json
@@ -20,6 +20,7 @@
     "framework",
     "sinatra",
     "web",
+    "http",
     "rest",
     "restful",
     "router",

From 67e64ca4c1c5b26cf971e6d6c35278d6357dc6bb Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Sat, 14 Dec 2019 14:19:18 -0500
Subject: [PATCH 203/479] docs: add Code of Conduct

closes #4143
---
 Code-Of-Conduct.md | 139 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 139 insertions(+)
 create mode 100644 Code-Of-Conduct.md

diff --git a/Code-Of-Conduct.md b/Code-Of-Conduct.md
new file mode 100644
index 00000000000..bbb8996a659
--- /dev/null
+++ b/Code-Of-Conduct.md
@@ -0,0 +1,139 @@
+# Contributor Covenant Code of Conduct
+
+As a member of the Open JS Foundation, Express has adopted the
+[Contributor Covenant 2.0][cc-20-doc].
+
+If an issue arises and you cannot resolve it directly with the parties
+involved, you can report it to the Express project TC through the following
+email: express-coc@lists.openjsf.org
+
+In addition, the OpenJS Foundation maintains a Code of Conduct Panel (CoCP).
+This is a foundation-wide team established to manage escalation when a reporter
+believes that a report to a member project or the CPC has not been properly
+handled. In order to escalate to the CoCP send an email to
+coc-escalation@lists.openjsf.org.
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances
+  of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for
+moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail
+address, posting via an official social media account, or acting as an
+appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+express-coc@lists.openjsf.org. All complaints will be reviewed and
+investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited
+interaction with those enforcing the Code of Conduct, is allowed during this
+period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+project community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant, version 2.0](cc-20-doc).
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
+
+[cc-20-doc]: https://www.contributor-covenant.org/version/2/0/code_of_conduct/
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

From 561b4b601e10e96fd9c2d2ff0b5e7573d2151617 Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Tue, 31 Dec 2019 09:41:27 -0800
Subject: [PATCH 204/479] docs: add Charter

closes #4144
---
 Charter.md | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 92 insertions(+)
 create mode 100644 Charter.md

diff --git a/Charter.md b/Charter.md
new file mode 100644
index 00000000000..c7057c718fd
--- /dev/null
+++ b/Charter.md
@@ -0,0 +1,92 @@
+# Express Charter
+
+## Section 0: Guiding Principles
+
+The Express project is part of the OpenJS Foundation which operates
+transparently, openly, collaboratively, and ethically.
+Project proposals, timelines, and status must not merely be open, but
+also easily visible to outsiders.
+
+## Section 1: Scope
+
+Express is a http web server framework with a simple and expressive API
+which is highly aligned with Node.js core. We aim to be be the best in
+class for writing performant, spec compliant and powerful web servers
+in Node.js. As one of the oldest and most popular web frameworks in
+the ecosystem, we have an important place for new users and experts
+alike.
+
+### 1.1: In-scope
+
+Express is made of many modules spread between three GitHub Orgs:
+
+- [expressjs](http://github.com/expressjs/): Top level middleware and
+  libraries
+- [pillarjs](http://github.com/pillarjs/): Components which make up
+  Express but can also be used for other web frameworks
+- [jshttp](http://github.com/jshttp/): Low level http libraries
+
+### 1.2: Out-of-Scope
+
+Section Intentionally Left Blank
+
+## Section 2: Relationship with OpenJS Foundation CPC.
+
+Technical leadership for the projects within the OpenJS Foundation is
+delegated to the projects through their project charters by the OpenJS
+Cross Project Council (CPC). In the case of the Express project, it is
+delegated to the Express Technical Committee ("TC").
+
+This Technical Committee is in charge of both the day-to-day operations
+of the project, as well as its techincal management. This charter can
+be amended by the TC requiring atleast two approvals and minium two
+week comment period for other TC members or CPC members to object. Any
+changes the CPC wishes to propose will be considered a priority but
+follow the same process.
+
+### 2.1 Other Formal Project Relationships
+
+Section Intentionally Left Blank
+
+## Section 3: Express Governing Body
+
+The Express project is managed by the Technical Committee ("TC").
+Members can be added to the TC at any time. Any committer can nominate
+another committer to the TC and the TC uses its standard consensus
+seeking process to evaluate whether or not to add this new member.
+Members who do not participate consistently at the level of a majority
+of the other members are expected to resign.
+
+## Section 4: Roles & Responsibilities
+
+The Express TC manages all aspects both the technical and community
+parts of the project. Members of the TC should attend the regular
+meetings when possible, and be available for discussion of time
+sensitive or important issues.
+
+### Section 4.1 Project Operations & Management
+
+Section Intentionally Left Blank
+
+### Section 4.2: Decision-making, Voting, and/or Elections
+
+The Express TC uses a "consensus seeking" process for issues that are
+escalated to the TC. The group tries to find a resolution that has no
+open objections among TC members. If a consensus cannot be reached
+that has no objections then a majority wins vote is called. It is also
+expected that the majority of decisions made by the TC are via a
+consensus seeking process and that voting is only used as a last-resort.
+
+Resolution may involve returning the issue to committers with
+suggestions on how to move forward towards a consensus. It is not
+expected that a meeting of the TC will resolve all issues on its
+agenda during that meeting and may prefer to continue the discussion
+happening among the committers.
+
+### Section 4.3: Other Project Roles
+
+Section Intentionally Left Blank
+
+## Section 5: Definitions
+
+Section Intentionally Left Blank

From 1b48a5cc3cdc6ee465991952990e14985cbfc042 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 14 Apr 2020 21:12:37 -0400
Subject: [PATCH 205/479] docs: fix heading levels

---
 Collaborator-Guide.md |  1 +
 Contributing.md       | 10 ++++------
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/Collaborator-Guide.md b/Collaborator-Guide.md
index 75d4e7c8f28..fc27b207376 100644
--- a/Collaborator-Guide.md
+++ b/Collaborator-Guide.md
@@ -1,3 +1,4 @@
+# Express Collaborator Guide
 
 ## Website Issues
 
diff --git a/Contributing.md b/Contributing.md
index f84c0138cb0..6dba2a05e51 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -15,7 +15,7 @@ contributors can be involved in decision making.
 * A **TC (Technical Committee)** is a group of committers representing the required technical
 expertise to resolve rare disputes.
 
-# Logging Issues
+## Logging Issues
 
 Log an issue for any question or problem you might have. When in doubt, log an issue, and
 any additional policies about what to include will be provided in the responses. The only
@@ -27,7 +27,7 @@ add appropriate metadata before the issue is addressed.
 Please be courteous and respectful. Every participant is expected to follow the
 project's Code of Conduct.
 
-# Contributions
+## Contributions
 
 Any change to resources in this repository must be through pull requests. This applies to all changes
 to documentation, code, binary files, etc. Even long term committers and TC members must use
@@ -56,7 +56,7 @@ discuss pending contributions in order to find a resolution. It is expected that
 small minority of issues be brought to the TC for resolution and that discussion and
 compromise among committers be the default resolution mechanism.
 
-# Becoming a Committer
+## Becoming a Committer
 
 All contributors who land a non-trivial contribution should be on-boarded in a timely manner,
 and added as a committer, and be given write access to the repository.
@@ -64,7 +64,7 @@ and added as a committer, and be given write access to the repository.
 Committers are expected to follow this policy and continue to send pull requests, go through
 proper review, and have other committers merge their pull requests.
 
-# TC Process
+## TC Process
 
 The TC uses a "consensus seeking" process for issues that are escalated to the TC.
 The group tries to find a resolution that has no open objections among TC members.
@@ -81,5 +81,3 @@ Members can be added to the TC at any time. Any committer can nominate another c
 to the TC and the TC uses its standard consensus seeking process to evaluate whether or
 not to add this new member. Members who do not participate consistently at the level of
 a majority of the other members are expected to resign.
-
-

From 18da651c5b57431f61391d9de2518a8c2ef88b2c Mon Sep 17 00:00:00 2001
From: Gireesh Punathil <gpunathi@in.ibm.com>
Date: Thu, 12 Dec 2019 11:28:45 -0500
Subject: [PATCH 206/479] docs: add triager guide

closes #4055
closes #4211
---
 Contributing.md  | 30 +++++++++++++++++++++++
 Triager-Guide.md | 63 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 93 insertions(+)
 create mode 100644 Triager-Guide.md

diff --git a/Contributing.md b/Contributing.md
index 6dba2a05e51..2d94b8a03e4 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -14,6 +14,7 @@ contributors can be involved in decision making.
 * A **Committer** is a subset of contributors who have been given write access to the repository.
 * A **TC (Technical Committee)** is a group of committers representing the required technical
 expertise to resolve rare disputes.
+* A **Triager** is a subset of contributors who have been given triage access to the repository.
 
 ## Logging Issues
 
@@ -56,6 +57,35 @@ discuss pending contributions in order to find a resolution. It is expected that
 small minority of issues be brought to the TC for resolution and that discussion and
 compromise among committers be the default resolution mechanism.
 
+## Becoming a Triager
+
+Anyone can become a triager! Read more about the process of being a triager in
+(the triage process document)[Triager-Guide.md].
+
+(Open an issue in `expressjs/express` repo)[https://github.com/expressjs/express/issues/new]
+to request the triage role. State that you have read and agree to the
+(Code of Conduct)[Code-of-Conduct.md] and details of the role.
+
+Here is an example issue content you can copy and paste:
+
+```
+Title: Request triager role for <your github username>
+
+I have read and understood the project's Code of Conduct.
+I also have read and understood the process and best practices around Express triaging.
+
+I request for a triager role for the following GitHub organizations:
+
+jshttp
+pillarjs
+express
+```
+
+Once you have opened your issue, a member of the TC will add you to the `triage` team in
+the organizations requested. They will then close the issue.
+
+Happy triaging!
+
 ## Becoming a Committer
 
 All contributors who land a non-trivial contribution should be on-boarded in a timely manner,
diff --git a/Triager-Guide.md b/Triager-Guide.md
new file mode 100644
index 00000000000..ed22e878f37
--- /dev/null
+++ b/Triager-Guide.md
@@ -0,0 +1,63 @@
+# Express Triager Guide
+
+## Issue Triage Process
+
+When a new issue or pull request is opened the issue will be labled with `needs triage`.
+If a traige team member is available they can help make sure all the required information
+is provided. Depending on the issue or PR there are several next labels they can add for further
+classification:
+
+* `needs triage`: This can be kept if the triager is unsure which next steps to take
+* `awaiting more info`: If more info has been requested from the author, apply this label.
+* `question`: User questions which do not appear to be bugs or enahncements.
+* `discuss`: Topics for discussion. Might end in an `enhancement` or `question` label.
+* `bug`: Issues that present a reasonable conviction there is a reproducible bug.
+* `enhancement`: Issues that are found to be a reasonable candidate feature additions.
+
+In all cases, issues may be closed by maintainers if they don't receive timely response when
+further information is sought, or when additional questions are asked.
+
+## Approaches and Best Practices for getting into triage contributions
+
+Review the organization's [StatusBoard](https://expressjs.github.io/statusboard/),
+pay special attention to these columns: stars, watchers, open issues and contributors.
+This gives you a general idea about the criticality and health of the repository.
+Pick a few projects based on that criteria, your interests, and skills (existing or aspiring).
+
+Review the project's contribution guideline if present. In a nutshell,
+commit to the community's standards and values. Review the
+documentation, for most of the projects it is just the README.md, and
+make sure you understand the key APIs, semantics, configurations, and use cases.
+
+It might be helpful to write your own test apps to re-affirm your
+understanding of the key functions. This may identify some gaps in
+documentation, record those as they might be good PR's to open.
+Skim through the issue backlog; identify low hanging issues and mostly new ones.
+From those, attempt to recreate issues based on the OP description and
+ask questions if required. No question is a bad question!
+
+## Removal of Triage Role
+
+There are a few cases where members can be removed as triagers:
+
+- Breaking the CoC or project contributor guidelines
+- Abuse or misuse of the role as deemed by the TC
+- Lack of participation for more than 6 months
+
+If any of these happen we will discuss as a part of the triage portion of the regular TC meetings.
+If you have questions feel free to reach out to any of the TC members.
+
+## Other Helpful Hints:
+
+- Everyone is welcome to attend the [Express Technical Committee Meetings](https://github.com/expressjs/discussions#expressjs-tc-meetings), and as a triager it might help to get a better idea of what's happening with the project.
+- When exploring the modules functionality there are a few helpful steps:
+  - Turn on `DEBUG=*` (see https://www.npmjs.com/package/debug) to get detailed log information
+  - It is also a good idea to do live debugging to follow the control flow, try using `node --inspect`
+  - It is a good idea to make at least one pass of reading through the entire source
+- When reviewing the list of open issues there are some common types and suggested actions:
+  - New/unattended issues or simple questions: A good place to start
+  - Hard bugs & ongoing discussions: always feel free to chime in and help
+  - Issues that imply gaps in documentation: open PRs with changes or help the user to do so
+- For recurring issues, it is helpful to create functional examples to demonstrate (publish as gists or a repo)
+- Review and identify the maintainers. If necessary, at-mention one or more of them if you are unsure what to do
+- Make sure all your interactions are professional, welcoming and respectful to the parties involved.

From 3ff1dbeb73732b6aae73f8df407e3bb423ccc3b7 Mon Sep 17 00:00:00 2001
From: Moni <usmoni@gmail.com>
Date: Sun, 14 Jun 2020 16:11:50 -0400
Subject: [PATCH 207/479] docs: fix markdown links in contributing

closes #4315
---
 Contributing.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 2d94b8a03e4..27d2137cd93 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -60,11 +60,11 @@ compromise among committers be the default resolution mechanism.
 ## Becoming a Triager
 
 Anyone can become a triager! Read more about the process of being a triager in
-(the triage process document)[Triager-Guide.md].
+[the triage process document](Triager-Guide.md).
 
-(Open an issue in `expressjs/express` repo)[https://github.com/expressjs/express/issues/new]
+[Open an issue in `expressjs/express` repo](https://github.com/expressjs/express/issues/new)
 to request the triage role. State that you have read and agree to the
-(Code of Conduct)[Code-of-Conduct.md] and details of the role.
+[Code of Conduct](Code-of-Conduct.md) and details of the role.
 
 Here is an example issue content you can copy and paste:
 

From c519886be5147466fdebdd4441a129c1070cebfb Mon Sep 17 00:00:00 2001
From: Yogi <me@yogi.codes>
Date: Tue, 16 Jun 2020 07:48:10 +0530
Subject: [PATCH 208/479] docs: fix typos in Charter

---
 Charter.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Charter.md b/Charter.md
index c7057c718fd..f9647cb734d 100644
--- a/Charter.md
+++ b/Charter.md
@@ -10,8 +10,8 @@ also easily visible to outsiders.
 ## Section 1: Scope
 
 Express is a http web server framework with a simple and expressive API
-which is highly aligned with Node.js core. We aim to be be the best in
-class for writing performant, spec compliant and powerful web servers
+which is highly aligned with Node.js core. We aim to be the best in
+class for writing performant, spec compliant, and powerful web servers
 in Node.js. As one of the oldest and most popular web frameworks in
 the ecosystem, we have an important place for new users and experts
 alike.
@@ -38,11 +38,11 @@ Cross Project Council (CPC). In the case of the Express project, it is
 delegated to the Express Technical Committee ("TC").
 
 This Technical Committee is in charge of both the day-to-day operations
-of the project, as well as its techincal management. This charter can
-be amended by the TC requiring atleast two approvals and minium two
+of the project, as well as its technical management. This charter can
+be amended by the TC requiring at least two approvals and a minimum two
 week comment period for other TC members or CPC members to object. Any
 changes the CPC wishes to propose will be considered a priority but
-follow the same process.
+will follow the same process.
 
 ### 2.1 Other Formal Project Relationships
 
@@ -59,7 +59,7 @@ of the other members are expected to resign.
 
 ## Section 4: Roles & Responsibilities
 
-The Express TC manages all aspects both the technical and community
+The Express TC manages all aspects of both the technical and community
 parts of the project. Members of the TC should attend the regular
 meetings when possible, and be available for discussion of time
 sensitive or important issues.

From 9007dcbdba37f921b679739d8f0b12b9e5a0015b Mon Sep 17 00:00:00 2001
From: Yogi <me@yogi.codes>
Date: Tue, 16 Jun 2020 07:51:00 +0530
Subject: [PATCH 209/479] docs: fix typos in Triager Guide

---
 Triager-Guide.md | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/Triager-Guide.md b/Triager-Guide.md
index ed22e878f37..a2909ef30db 100644
--- a/Triager-Guide.md
+++ b/Triager-Guide.md
@@ -2,25 +2,25 @@
 
 ## Issue Triage Process
 
-When a new issue or pull request is opened the issue will be labled with `needs triage`.
-If a traige team member is available they can help make sure all the required information
+When a new issue or pull request is opened the issue will be labeled with `needs triage`.
+If a triage team member is available they can help make sure all the required information
 is provided. Depending on the issue or PR there are several next labels they can add for further
 classification:
 
 * `needs triage`: This can be kept if the triager is unsure which next steps to take
 * `awaiting more info`: If more info has been requested from the author, apply this label.
-* `question`: User questions which do not appear to be bugs or enahncements.
+* `question`: User questions that do not appear to be bugs or enhancements.
 * `discuss`: Topics for discussion. Might end in an `enhancement` or `question` label.
 * `bug`: Issues that present a reasonable conviction there is a reproducible bug.
 * `enhancement`: Issues that are found to be a reasonable candidate feature additions.
 
-In all cases, issues may be closed by maintainers if they don't receive timely response when
+In all cases, issues may be closed by maintainers if they don't receive a timely response when
 further information is sought, or when additional questions are asked.
 
 ## Approaches and Best Practices for getting into triage contributions
 
 Review the organization's [StatusBoard](https://expressjs.github.io/statusboard/),
-pay special attention to these columns: stars, watchers, open issues and contributors.
+pay special attention to these columns: stars, watchers, open issues, and contributors.
 This gives you a general idea about the criticality and health of the repository.
 Pick a few projects based on that criteria, your interests, and skills (existing or aspiring).
 
@@ -49,15 +49,15 @@ If you have questions feel free to reach out to any of the TC members.
 
 ## Other Helpful Hints:
 
-- Everyone is welcome to attend the [Express Technical Committee Meetings](https://github.com/expressjs/discussions#expressjs-tc-meetings), and as a triager it might help to get a better idea of what's happening with the project.
-- When exploring the modules functionality there are a few helpful steps:
+- Everyone is welcome to attend the [Express Technical Committee Meetings](https://github.com/expressjs/discussions#expressjs-tc-meetings), and as a triager, it might help to get a better idea of what's happening with the project.
+- When exploring the module's functionality there are a few helpful steps:
   - Turn on `DEBUG=*` (see https://www.npmjs.com/package/debug) to get detailed log information
   - It is also a good idea to do live debugging to follow the control flow, try using `node --inspect`
   - It is a good idea to make at least one pass of reading through the entire source
 - When reviewing the list of open issues there are some common types and suggested actions:
   - New/unattended issues or simple questions: A good place to start
   - Hard bugs & ongoing discussions: always feel free to chime in and help
-  - Issues that imply gaps in documentation: open PRs with changes or help the user to do so
+  - Issues that imply gaps in the documentation: open PRs with changes or help the user to do so
 - For recurring issues, it is helpful to create functional examples to demonstrate (publish as gists or a repo)
 - Review and identify the maintainers. If necessary, at-mention one or more of them if you are unsure what to do
-- Make sure all your interactions are professional, welcoming and respectful to the parties involved.
+- Make sure all your interactions are professional, welcoming, and respectful to the parties involved.

From a75728432eee59cd51cff25e8d393a4e39af1693 Mon Sep 17 00:00:00 2001
From: Yogi <me@yogi.codes>
Date: Tue, 16 Jun 2020 07:52:29 +0530
Subject: [PATCH 210/479] docs: fix typos in Collaborator Guide

---
 Collaborator-Guide.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Collaborator-Guide.md b/Collaborator-Guide.md
index fc27b207376..3c73307d61b 100644
--- a/Collaborator-Guide.md
+++ b/Collaborator-Guide.md
@@ -22,7 +22,7 @@ a future release of Express.
 
 1. [Create an issue](https://github.com/expressjs/express/issues/new) for the
    bug you want to fix or the feature that you want to add.
-2. Create your own [fork](https://github.com/expressjs/express) on github, then
+2. Create your own [fork](https://github.com/expressjs/express) on GitHub, then
    checkout your fork.
 3. Write your code in your local copy. It's good practice to create a branch for
    each new issue you work on, although not compulsory.

From ecd8a08c1c9c4d60b466b451fd1f5c3fe8a5fb23 Mon Sep 17 00:00:00 2001
From: Yogi <me@yogi.codes>
Date: Tue, 16 Jun 2020 07:54:06 +0530
Subject: [PATCH 211/479] docs: fix typos in Contributing

---
 Contributing.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 27d2137cd93..9473a5a58f5 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -42,7 +42,7 @@ weekends and other holiday periods to ensure active committers all have reasonab
 become involved in the discussion and review process if they wish.
 
 The default for each contribution is that it is accepted once no committer has an objection.
-During review committers may also request that a specific contributor who is most versed in a
+During a review, committers may also request that a specific contributor who is most versed in a
 particular area gives a "LGTM" before the PR can be merged. There is no additional "sign off"
 process for contributions to land. Once all issues brought by committers are addressed it can
 be landed by any committer.
@@ -69,7 +69,7 @@ to request the triage role. State that you have read and agree to the
 Here is an example issue content you can copy and paste:
 
 ```
-Title: Request triager role for <your github username>
+Title: Request triager role for <your GitHub username>
 
 I have read and understood the project's Code of Conduct.
 I also have read and understood the process and best practices around Express triaging.

From 4486fa6324eaeb8e53482df961c755cc9013a36e Mon Sep 17 00:00:00 2001
From: yasser <spookyframework@gmail.com>
Date: Thu, 16 Jul 2020 18:51:56 +0200
Subject: [PATCH 212/479] docs: fix Code of Conduct link in Contributing

closes #4351
---
 Contributing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Contributing.md b/Contributing.md
index 9473a5a58f5..485dee597e1 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -64,7 +64,7 @@ Anyone can become a triager! Read more about the process of being a triager in
 
 [Open an issue in `expressjs/express` repo](https://github.com/expressjs/express/issues/new)
 to request the triage role. State that you have read and agree to the
-[Code of Conduct](Code-of-Conduct.md) and details of the role.
+[Code of Conduct](Code-Of-Conduct.md) and details of the role.
 
 Here is an example issue content you can copy and paste:
 

From fe67523b9cdc60c42fe1fbf0f600cb2191818208 Mon Sep 17 00:00:00 2001
From: Rodion Abdurakhimov <rodion.arr.web@gmail.com>
Date: Sun, 19 Jul 2020 14:51:10 +0300
Subject: [PATCH 213/479] docs: add examples summary page

closes #4343
closes #4354
---
 examples/README.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 examples/README.md

diff --git a/examples/README.md b/examples/README.md
new file mode 100644
index 00000000000..fdbc45d54fa
--- /dev/null
+++ b/examples/README.md
@@ -0,0 +1,30 @@
+# Express examples
+
+This page contains list of examples using Express.
+
+- [auth](./auth) - Authentication with login and password
+- [content-negotiation](./content-negotiation) - HTTP content negotiation
+- [cookie-sessions](./cookie-sessions) - Working with cookie-based session
+- [cookies](./cookies) - Working with cookies
+- [downloads](./downloads) - Transferring files to client
+- [ejs](./ejs) - Working with Embedded JavaScript templating (ejs)
+- [error-pages](./error-pages) - Creating error pages
+- [error](./error) - Working with error middleware
+- [hello-world](./hello-world) - Simple request handler
+- [markdown](./markdown) - Markdown as template engine
+- [multi-router](./multi-router) - Working with multiple express routers
+- [multipart](./multipart) - Accepting multipart-encoded forms
+- [mvc](./mvc) - MVC style controllers
+- [online](./online) - Tracking online user activity with `online` and `redis` packages
+- [params](./params) - Working with route parameters
+- [resource](./resource) - Multiple HTTP operations on the same resource
+- [route-map](./route-map) - Organizing routes using map
+- [route-middleware](./route-middleware) - Working with route middleware
+- [route-separation](./route-separation) - Organizing routes per each resource
+- [search](./search) - Search API
+- [session](./session) - User sessions
+- [static-files](./static-files) - Serving static files
+- [vhost](./vhost) - Working with virtual hosts
+- [view-constructor](./view-constructor) - Rendering views dynamically
+- [view-locals](./view-locals) - Saving data in request object between middleware calls
+- [web-service](./web-service) - Simple API service

From 5596222f6a6e0eea74f6fb38915b071d98122a2f Mon Sep 17 00:00:00 2001
From: Rodion Abdurakhimov <rodion.arr.web@gmail.com>
Date: Fri, 31 Jul 2020 11:02:18 +0300
Subject: [PATCH 214/479] docs: update example summaries

closes #4370
---
 examples/README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/examples/README.md b/examples/README.md
index fdbc45d54fa..c19ed30a25c 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -4,7 +4,7 @@ This page contains list of examples using Express.
 
 - [auth](./auth) - Authentication with login and password
 - [content-negotiation](./content-negotiation) - HTTP content negotiation
-- [cookie-sessions](./cookie-sessions) - Working with cookie-based session
+- [cookie-sessions](./cookie-sessions) - Working with cookie-based sessions
 - [cookies](./cookies) - Working with cookies
 - [downloads](./downloads) - Transferring files to client
 - [ejs](./ejs) - Working with Embedded JavaScript templating (ejs)
@@ -12,13 +12,13 @@ This page contains list of examples using Express.
 - [error](./error) - Working with error middleware
 - [hello-world](./hello-world) - Simple request handler
 - [markdown](./markdown) - Markdown as template engine
-- [multi-router](./multi-router) - Working with multiple express routers
+- [multi-router](./multi-router) - Working with multiple Express routers
 - [multipart](./multipart) - Accepting multipart-encoded forms
-- [mvc](./mvc) - MVC style controllers
+- [mvc](./mvc) - MVC-style controllers
 - [online](./online) - Tracking online user activity with `online` and `redis` packages
 - [params](./params) - Working with route parameters
 - [resource](./resource) - Multiple HTTP operations on the same resource
-- [route-map](./route-map) - Organizing routes using map
+- [route-map](./route-map) - Organizing routes using a map
 - [route-middleware](./route-middleware) - Working with route middleware
 - [route-separation](./route-separation) - Organizing routes per each resource
 - [search](./search) - Search API

From 508936853a6e311099c9985d4c11a4b1b8f6af07 Mon Sep 17 00:00:00 2001
From: H3RSKO <34112131+H3RSKO@users.noreply.github.com>
Date: Fri, 14 Aug 2020 17:07:43 -0400
Subject: [PATCH 215/479] docs: update grammar in readme

closes #4376
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 9b15b440d72..f1ddaef0be1 100644
--- a/Readme.md
+++ b/Readme.md
@@ -98,7 +98,7 @@ $ npm start
 ## Philosophy
 
   The Express philosophy is to provide small, robust tooling for HTTP servers, making
-  it a great solution for single page applications, web sites, hybrids, or public
+  it a great solution for single page applications, websites, hybrids, or public
   HTTP APIs.
 
   Express does not force you to use any specific ORM or template engine. With support for over

From 2a2dd5d32ba9f37d38390d56a267c4913456a8d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 19 Oct 2020 21:33:05 -0400
Subject: [PATCH 216/479] build: Node.js@10.23

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 37735595818..9393e3580f4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.19"
+  - "10.23"
   - "11.15"
   - "12.16"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index 94d25b3d535..17989df2155 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,7 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.16"
     - nodejs_version: "9.11"
-    - nodejs_version: "10.19"
+    - nodejs_version: "10.23"
     - nodejs_version: "11.15"
     - nodejs_version: "12.16"
 cache:

From de122c14f5b57b3dadbf3e33020cd5ad22e9d04d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Oct 2020 19:48:58 -0400
Subject: [PATCH 217/479] build: Node.js@12.18

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 9393e3580f4..c5ac1dd3c03 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "9.11"
   - "10.23"
   - "11.15"
-  - "12.16"
+  - "12.18"
 matrix:
   include:
     - node_js: "13"
diff --git a/appveyor.yml b/appveyor.yml
index 17989df2155..453006eda8a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,7 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.23"
     - nodejs_version: "11.15"
-    - nodejs_version: "12.16"
+    - nodejs_version: "12.18"
 cache:
   - node_modules
 install:

From 5c4f3e7cc76fed9b42c27cebcdd9d66ef63092f9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Nov 2020 21:44:32 -0500
Subject: [PATCH 218/479] build: supertest@6.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 9b841872f4a..fc1deabfec2 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "4.0.2",
+    "supertest": "6.0.1",
     "vhost": "~3.0.2"
   },
   "engines": {

From 280a8d39ecd583d1d498dfceb624ff776704f374 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Dec 2020 23:41:28 -0500
Subject: [PATCH 219/479] build: fix Node.js version check in AppVeyor

---
 appveyor.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/appveyor.yml b/appveyor.yml
index 453006eda8a..23eb79876df 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -35,20 +35,20 @@ install:
       # - use 3.x for Node.js < 4
       # - use 5.x for Node.js < 6
       # - use 6.x for Node.js < 8
-      if ($env:nodejs_version.split(".")[0] -lt 4) {
+      if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev mocha@3.5.3
-      } elseif ($env:nodejs_version.split(".")[0] -lt 6) {
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
         npm install --silent --save-dev mocha@5.2.0
-      } elseif ($env:nodejs_version.split(".")[0] -lt 8) {
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 8) {
         npm install --silent --save-dev mocha@6.2.2
       }
   - ps: |
       # supertest for http calls
       # - use 2.0.0 for Node.js < 4
       # - use 3.4.2 for Node.js < 6
-      if ($env:nodejs_version.split(".")[0] -lt 4) {
+      if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev supertest@2.0.0
-      } elseif ($env:nodejs_version.split(".")[0] -lt 6) {
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
         npm install --silent --save-dev supertest@3.4.2
       }
   # Update Node.js modules

From 685d4665fddeed892528ee041f706ee6a8b3b2b6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Dec 2020 20:41:52 -0500
Subject: [PATCH 220/479] build: mocha@8.2.1

---
 .travis.yml  | 3 +++
 appveyor.yml | 3 +++
 package.json | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c5ac1dd3c03..325b1e52057 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -39,12 +39,15 @@ before_install:
     # - use 3.x for Node.js < 4
     # - use 5.x for Node.js < 6
     # - use 6.x for Node.js < 8
+    # - use 7.x for Node.js < 10
     if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
       npm install --silent --save-dev mocha@3.5.3
     elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
       npm install --silent --save-dev mocha@5.2.0
     elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 8 ]]; then
       npm install --silent --save-dev mocha@6.2.2
+    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+      npm install --silent --save-dev mocha@7.2.0
     fi
   - |
     # supertest for http calls
diff --git a/appveyor.yml b/appveyor.yml
index 23eb79876df..6ad289d83c9 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -35,12 +35,15 @@ install:
       # - use 3.x for Node.js < 4
       # - use 5.x for Node.js < 6
       # - use 6.x for Node.js < 8
+      # - use 7.x for Node.js < 10
       if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev mocha@3.5.3
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
         npm install --silent --save-dev mocha@5.2.0
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 8) {
         npm install --silent --save-dev mocha@6.2.2
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 10) {
+        npm install --silent --save-dev mocha@7.2.0
       }
   - ps: |
       # supertest for http calls
diff --git a/package.json b/package.json
index fc1deabfec2..4c36ad4e71b 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "istanbul": "0.4.5",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "7.0.1",
+    "mocha": "8.2.1",
     "morgan": "1.9.1",
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",

From 28db2c2c5cf992c897d1fbbc6b119ee02fe32ab1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Jan 2021 20:17:55 -0500
Subject: [PATCH 221/479] build: supertest@6.1.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4c36ad4e71b..121ab6c7d4d 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "6.0.1",
+    "supertest": "6.1.3",
     "vhost": "~3.0.2"
   },
   "engines": {

From ca3c8634289ab20a787572bedcb3261f9336fbb5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 1 Jul 2021 15:22:40 -0400
Subject: [PATCH 222/479] build: use GitHub Actions instead of Travis CI

---
 .github/workflows/ci.yml | 134 +++++++++++++++++++++++++++++++++++++++
 .travis.yml              |  77 ----------------------
 Readme.md                |   6 +-
 3 files changed, 137 insertions(+), 80 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 delete mode 100644 .travis.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000000..989f692f36a
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,134 @@
+name: ci
+
+on:
+- pull_request
+- push
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        name:
+        - Node.js 0.10
+        - Node.js 0.12
+        - io.js 1.x
+        - io.js 2.x
+        - io.js 3.x
+        - Node.js 4.x
+        - Node.js 5.x
+        - Node.js 6.x
+        - Node.js 7.x
+        - Node.js 8.x
+        - Node.js 9.x
+        - Node.js 10.x
+        - Node.js 11.x
+        - Node.js 12.x
+
+        include:
+        - name: Node.js 0.10
+          node-version: "0.10"
+          npm-i: mocha@3.5.3 supertest@2.0.0
+
+        - name: Node.js 0.12
+          node-version: "0.12"
+          npm-i: mocha@3.5.3 supertest@2.0.0
+
+        - name: io.js 1.x
+          node-version: "1.8"
+          npm-i: mocha@3.5.3 supertest@2.0.0
+
+        - name: io.js 2.x
+          node-version: "2.5"
+          npm-i: mocha@3.5.3 supertest@2.0.0
+
+        - name: io.js 3.x
+          node-version: "3.3"
+          npm-i: mocha@3.5.3 supertest@2.0.0
+
+        - name: Node.js 4.x
+          node-version: "4.9"
+          npm-i: mocha@5.2.0 supertest@3.4.2
+
+        - name: Node.js 5.x
+          node-version: "5.12"
+          npm-i: mocha@5.2.0 supertest@3.4.2
+
+        - name: Node.js 6.x
+          node-version: "6.17"
+          npm-i: mocha@6.2.2
+
+        - name: Node.js 7.x
+          node-version: "7.10"
+          npm-i: mocha@6.2.2
+
+        - name: Node.js 8.x
+          node-version: "8.17"
+          npm-i: mocha@7.2.0
+
+        - name: Node.js 9.x
+          node-version: "9.11"
+          npm-i: mocha@7.2.0
+
+        - name: Node.js 10.x
+          node-version: "10.23"
+
+        - name: Node.js 11.x
+          node-version: "11.15"
+
+        - name: Node.js 12.x
+          node-version: "12.18"
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Install Node.js ${{ matrix.node-version }}
+      shell: bash -eo pipefail -l {0}
+      run: |
+        nvm install --default ${{ matrix.node-version }}
+        dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
+
+    - name: Configure npm
+      run: npm config set shrinkwrap false
+
+    - name: Install npm module(s) ${{ matrix.npm-i }}
+      run: npm install --save-dev ${{ matrix.npm-i }}
+      if: matrix.npm-i != ''
+
+    - name: Remove non-test dependencies
+      run: npm rm --silent --save-dev connect-redis
+
+    - name: Install Node.js dependencies
+      run: npm install
+
+    - name: List environment
+      id: list_env
+      shell: bash
+      run: |
+        echo "node@$(node -v)"
+        echo "npm@$(npm -v)"
+        npm -s ls ||:
+
+    - name: Run tests
+      shell: bash
+      run: npm run test-ci
+
+    - name: Lint code
+      run: npm run lint
+
+    - name: Collect code coverage
+      uses: coverallsapp/github-action@master
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        flag-name: run-${{ matrix.test_number }}
+        parallel: true
+
+  coverage:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+    - name: Upload code coverage
+      uses: coverallsapp/github-action@master
+      with:
+        github-token: ${{ secrets.github_token }}
+        parallel-finished: true
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 325b1e52057..00000000000
--- a/.travis.yml
+++ /dev/null
@@ -1,77 +0,0 @@
-language: node_js
-node_js:
-  - "0.10"
-  - "0.12"
-  - "1.8"
-  - "2.5"
-  - "3.3"
-  - "4.9"
-  - "5.12"
-  - "6.17"
-  - "7.10"
-  - "8.17"
-  - "9.11"
-  - "10.23"
-  - "11.15"
-  - "12.18"
-matrix:
-  include:
-    - node_js: "13"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
-  allow_failures:
-    # Allow the nightly installs to fail
-    - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
-cache:
-  directories:
-    - node_modules
-before_install:
-  # Configure npm
-  - |
-    # Skip updating shrinkwrap / lock
-    npm config set shrinkwrap false
-  # Remove all non-test dependencies
-  - |
-    # Remove example dependencies
-    npm rm --silent --save-dev connect-redis
-  # Setup Node.js version-specific dependencies
-  - |
-    # mocha for testing
-    # - use 3.x for Node.js < 4
-    # - use 5.x for Node.js < 6
-    # - use 6.x for Node.js < 8
-    # - use 7.x for Node.js < 10
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
-      npm install --silent --save-dev mocha@3.5.3
-    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
-      npm install --silent --save-dev mocha@5.2.0
-    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 8 ]]; then
-      npm install --silent --save-dev mocha@6.2.2
-    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
-      npm install --silent --save-dev mocha@7.2.0
-    fi
-  - |
-    # supertest for http calls
-    # - use 2.0.0 for Node.js < 4
-    # - use 3.4.2 for Node.js < 6
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
-      npm install --silent --save-dev supertest@2.0.0
-    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
-      npm install --silent --save-dev supertest@3.4.2
-    fi
-  # Update Node.js modules
-  - |
-    # Prune and rebuild node_modules
-    if [[ -d node_modules ]]; then
-      npm prune
-      npm rebuild
-    fi
-script:
-  # Run test script
-  - npm run test-ci
-  # Run linting
-  - npm run lint
-after_script:
-  - |
-    # Upload coverage to coveralls
-    npm install --save-dev coveralls@2.12.0
-    coveralls < ./coverage/lcov.info
diff --git a/Readme.md b/Readme.md
index f1ddaef0be1..b60d588c413 100644
--- a/Readme.md
+++ b/Readme.md
@@ -4,7 +4,7 @@
 
   [![NPM Version][npm-image]][npm-url]
   [![NPM Downloads][downloads-image]][downloads-url]
-  [![Linux Build][travis-image]][travis-url]
+  [![Linux Build][ci-image]][ci-url]
   [![Windows Build][appveyor-image]][appveyor-url]
   [![Test Coverage][coveralls-image]][coveralls-url]
 
@@ -146,12 +146,12 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 
   [MIT](LICENSE)
 
+[ci-image]: https://img.shields.io/github/workflow/status/expressjs/express/ci/master.svg?label=linux
+[ci-url]: https://github.com/expressjs/express/actions?query=workflow%3Aci
 [npm-image]: https://img.shields.io/npm/v/express.svg
 [npm-url]: https://npmjs.org/package/express
 [downloads-image]: https://img.shields.io/npm/dm/express.svg
 [downloads-url]: https://npmcharts.com/compare/express?minimal=true
-[travis-image]: https://img.shields.io/travis/expressjs/express/master.svg?label=linux
-[travis-url]: https://travis-ci.org/expressjs/express
 [appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/express/master.svg?label=windows
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
 [coveralls-image]: https://img.shields.io/coveralls/expressjs/express/master.svg

From 24021269886a90baecfa820efd18fbd69609d182 Mon Sep 17 00:00:00 2001
From: Aravind Nair <22199259+aravindvnair99@users.noreply.github.com>
Date: Fri, 2 Jul 2021 18:18:04 +0530
Subject: [PATCH 223/479] build: disable fast-fail for GitHub Actions

closes #4628
---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 989f692f36a..8ac9eaecc15 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         name:
         - Node.js 0.10

From 0fbbc2963296832b41449eb21f873e0d314d359c Mon Sep 17 00:00:00 2001
From: Abderrahmenla <abdo.vic@hotmail.com>
Date: Wed, 12 May 2021 00:50:30 +0100
Subject: [PATCH 224/479] lint: coalesce duplicate switch statements

closes #4587
---
 lib/utils.js | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/lib/utils.js b/lib/utils.js
index bd81ac7f6d9..a9ef259ff1e 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -157,6 +157,7 @@ exports.compileETag = function(val) {
 
   switch (val) {
     case true:
+    case 'weak':
       fn = exports.wetag;
       break;
     case false:
@@ -164,9 +165,6 @@ exports.compileETag = function(val) {
     case 'strong':
       fn = exports.etag;
       break;
-    case 'weak':
-      fn = exports.wetag;
-      break;
     default:
       throw new TypeError('unknown value for etag function: ' + val);
   }
@@ -191,6 +189,7 @@ exports.compileQueryParser = function compileQueryParser(val) {
 
   switch (val) {
     case true:
+    case 'simple':
       fn = querystring.parse;
       break;
     case false:
@@ -199,9 +198,6 @@ exports.compileQueryParser = function compileQueryParser(val) {
     case 'extended':
       fn = parseExtendedQueryString;
       break;
-    case 'simple':
-      fn = querystring.parse;
-      break;
     default:
       throw new TypeError('unknown value for query parser function: ' + val);
   }

From 8e4add7f749796b850af6ddd4cebfdc6185e2fd5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 Jul 2021 16:19:55 -0400
Subject: [PATCH 225/479] tests: remove should usage from Router tests

fixes #4635
---
 test/Router.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/Router.js b/test/Router.js
index 47c5e65481a..16522f6aa86 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -32,7 +32,7 @@ describe('Router', function(){
     var another = new Router();
 
     another.get('/:bar', function(req, res){
-      req.params.bar.should.equal('route');
+      assert.strictEqual(req.params.bar, 'route')
       res.end();
     });
     router.use('/:foo', another);
@@ -44,7 +44,7 @@ describe('Router', function(){
     var router = new Router();
 
     router.use(function (req, res) {
-      false.should.be.true()
+      throw new Error('should not be called')
     });
 
     router.handle({ url: '', method: 'GET' }, {}, done);
@@ -85,7 +85,7 @@ describe('Router', function(){
 
       var res = {
         send: function(val) {
-          val.should.equal('foo');
+          assert.strictEqual(val, 'foo')
           done();
         }
       }

From 30afebf8dae8a810c92d3d26d4fceced39324fc4 Mon Sep 17 00:00:00 2001
From: Lutger Kunst <lutger@gmail.com>
Date: Mon, 22 Mar 2021 21:42:52 +0100
Subject: [PATCH 226/479] examples: fixed typo in ejs example css

closes #4554
---
 examples/ejs/public/stylesheets/style.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/ejs/public/stylesheets/style.css b/examples/ejs/public/stylesheets/style.css
index c4593b44211..db60b89fe6c 100644
--- a/examples/ejs/public/stylesheets/style.css
+++ b/examples/ejs/public/stylesheets/style.css
@@ -1,4 +1,4 @@
 body {
   padding: 50px 80px;
-  font: 14px "Helvetica Nueue", "Lucida Grande", Arial, sans-serif;
+  font: 14px "Helvetica Neue", "Lucida Grande", Arial, sans-serif;
 }

From 135a05c524796329a97f4bdb69a00f765dd80393 Mon Sep 17 00:00:00 2001
From: Hussein Mohamed <hussein.abdallah96@eng-st.cu.edu.eg>
Date: Sun, 11 Apr 2021 22:28:56 +0200
Subject: [PATCH 227/479] docs: fix typos in jsdoc

closes #4564
---
 lib/application.js | 2 +-
 lib/response.js    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 91f77d241e4..e65ba588959 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -276,7 +276,7 @@ app.route = function route(path) {
  * In this case EJS provides a `.renderFile()` method with
  * the same signature that Express expects: `(path, options, callback)`,
  * though note that it aliases this method as `ejs.__express` internally
- * so if you're using ".ejs" extensions you dont need to do anything.
+ * so if you're using ".ejs" extensions you don't need to do anything.
  *
  * Some template engines do not follow this convention, the
  * [Consolidate.js](https://github.com/tj/consolidate.js)
diff --git a/lib/response.js b/lib/response.js
index c9f08cd54f4..c0adc878f50 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -623,7 +623,7 @@ res.type = function contentType(type) {
  *        res.send('<p>hey</p>');
  *      },
  *
- *      'appliation/json': function(){
+ *      'application/json': function () {
  *        res.send({ message: 'hey' });
  *      }
  *    });

From 52e9bd67b76f2328afd75edef1d1b650f8954961 Mon Sep 17 00:00:00 2001
From: Hussein Mohamed <hussein.abdallah96@eng-st.cu.edu.eg>
Date: Sun, 11 Apr 2021 22:49:52 +0200
Subject: [PATCH 228/479] tests: fix typos

closes #4564
---
 test/app.param.js      | 2 +-
 test/express.static.js | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/app.param.js b/test/app.param.js
index 8785567751f..577b00710b3 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -185,7 +185,7 @@ describe('app', function(){
       });
 
       app.param('user', function(req, res, next, user) {
-        next(new Error('invalid invokation'));
+        next(new Error('invalid invocation'))
       });
 
       app.post('/:user', function(req, res, next) {
diff --git a/test/express.static.js b/test/express.static.js
index 485ee4c0c10..56d3657bff0 100644
--- a/test/express.static.js
+++ b/test/express.static.js
@@ -429,7 +429,7 @@ describe('express.static()', function () {
 
   describe('lastModified', function () {
     describe('when false', function () {
-      it('should not include Last-Modifed', function (done) {
+      it('should not include Last-Modified', function (done) {
         request(createApp(fixtures, { 'lastModified': false }))
           .get('/nums.txt')
           .expect(utils.shouldNotHaveHeader('Last-Modified'))
@@ -438,7 +438,7 @@ describe('express.static()', function () {
     })
 
     describe('when true', function () {
-      it('should include Last-Modifed', function (done) {
+      it('should include Last-Modified', function (done) {
         request(createApp(fixtures, { 'lastModified': true }))
           .get('/nums.txt')
           .expect('Last-Modified', /^\w{3}, \d+ \w+ \d+ \d+:\d+:\d+ \w+$/)

From eb76236e2fc027154a477d616741eaf4c1cb8583 Mon Sep 17 00:00:00 2001
From: alberto barboza <devalbertobarboza@gmail.com>
Date: Sun, 11 Jul 2021 12:41:56 -0400
Subject: [PATCH 229/479] build: hbs@4.1.2

closes #4643
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 121ab6c7d4d..6d5ce3742e1 100644
--- a/package.json
+++ b/package.json
@@ -67,7 +67,7 @@
     "ejs": "2.7.2",
     "eslint": "2.13.1",
     "express-session": "1.17.0",
-    "hbs": "4.1.0",
+    "hbs": "4.1.2",
     "istanbul": "0.4.5",
     "marked": "0.7.0",
     "method-override": "3.0.0",

From 884e080a19015a81a46aef73792be12ad3220715 Mon Sep 17 00:00:00 2001
From: Aravind Nair <22199259+aravindvnair99@users.noreply.github.com>
Date: Fri, 23 Apr 2021 00:40:06 +0530
Subject: [PATCH 230/479] build: ejs@3.1.6

closes #4572
closes #4573
---
 examples/auth/views/login.ejs                   | 5 ++---
 examples/ejs/views/users.html                   | 4 ++--
 examples/error-pages/views/404.ejs              | 4 ++--
 examples/error-pages/views/500.ejs              | 4 ++--
 examples/route-separation/views/index.ejs       | 4 ++--
 examples/route-separation/views/posts/index.ejs | 4 ++--
 examples/route-separation/views/users/edit.ejs  | 4 ++--
 examples/route-separation/views/users/index.ejs | 4 ++--
 examples/route-separation/views/users/view.ejs  | 4 ++--
 package.json                                    | 2 +-
 10 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/examples/auth/views/login.ejs b/examples/auth/views/login.ejs
index 948c5d1c904..8a20411a2ca 100644
--- a/examples/auth/views/login.ejs
+++ b/examples/auth/views/login.ejs
@@ -1,6 +1,5 @@
 
-<% var title = 'Authentication Example' %>
-<% include head %>
+<%- include('head', { title: 'Authentication Example' }) -%>
 
 <h1>Login</h1>
 <%- message %>
@@ -19,4 +18,4 @@ Try accessing <a href="/restricted">/restricted</a>, then authenticate with "tj"
   </p>
 </form>
 
-<% include foot %>
+<%- include('foot') -%>
diff --git a/examples/ejs/views/users.html b/examples/ejs/views/users.html
index b0640750f2a..dad24625e65 100644
--- a/examples/ejs/views/users.html
+++ b/examples/ejs/views/users.html
@@ -1,4 +1,4 @@
-<% include header.html %>
+<%- include('header.html') -%>
 
 <h1>Users</h1>
 <ul id="users">
@@ -7,4 +7,4 @@ <h1>Users</h1>
   <% }) %>
 </ul>
 
-<% include footer.html %>
+<%- include('footer.html') -%>
diff --git a/examples/error-pages/views/404.ejs b/examples/error-pages/views/404.ejs
index a72369e2d2c..d992ce02294 100644
--- a/examples/error-pages/views/404.ejs
+++ b/examples/error-pages/views/404.ejs
@@ -1,3 +1,3 @@
-<% include error_header %>
+<%- include('error_header') -%>
 <h2>Cannot find <%= url %></h2>
-<% include footer %>
+<%- include('footer') -%>
diff --git a/examples/error-pages/views/500.ejs b/examples/error-pages/views/500.ejs
index 8c1e0e80fb8..c9d855f8044 100644
--- a/examples/error-pages/views/500.ejs
+++ b/examples/error-pages/views/500.ejs
@@ -1,8 +1,8 @@
-<% include error_header %>
+<%- include('error_header') -%>
 <h2>Error: <%= error.message %></h2>
 <% if (settings['verbose errors']) { %>
   <pre><%= error.stack %></pre>
 <% } else { %>
   <p>An error occurred!</p>
 <% } %>
-<% include footer %>
+<%- include('footer') -%>
diff --git a/examples/route-separation/views/index.ejs b/examples/route-separation/views/index.ejs
index 2a0b095fa36..7fd75879c11 100644
--- a/examples/route-separation/views/index.ejs
+++ b/examples/route-separation/views/index.ejs
@@ -1,4 +1,4 @@
-<% include header %>
+<%- include('header') -%>
 
 <h1><%= title %></h1>
 
@@ -7,4 +7,4 @@
   <li>Visit the <a href="/posts">posts</a> page.</li>
 </ul>
 
-<% include footer %>
+<%- include('footer') -%>
diff --git a/examples/route-separation/views/posts/index.ejs b/examples/route-separation/views/posts/index.ejs
index 12303444858..cbcebffebf1 100644
--- a/examples/route-separation/views/posts/index.ejs
+++ b/examples/route-separation/views/posts/index.ejs
@@ -1,4 +1,4 @@
-<% include ../header %>
+<%- include('../header') -%>
 
 <h1>Posts</h1>
 
@@ -9,4 +9,4 @@
   <% }) %>
 </dl>
 
-<% include ../footer %>
+<%- include('../footer') -%>
diff --git a/examples/route-separation/views/users/edit.ejs b/examples/route-separation/views/users/edit.ejs
index c64160e037f..0ca2df7652d 100644
--- a/examples/route-separation/views/users/edit.ejs
+++ b/examples/route-separation/views/users/edit.ejs
@@ -1,4 +1,4 @@
-<% include ../header %>
+<%- include('../header') -%>
 
 <h1>Editing <%= user.name %></h1>
 
@@ -20,4 +20,4 @@
   </form>
 </div>
 
-<% include ../footer %>
+<%- include('../footer') -%>
diff --git a/examples/route-separation/views/users/index.ejs b/examples/route-separation/views/users/index.ejs
index 0f97fc691c0..949412a21e1 100644
--- a/examples/route-separation/views/users/index.ejs
+++ b/examples/route-separation/views/users/index.ejs
@@ -1,4 +1,4 @@
-<% include ../header %>
+<%- include('../header') -%>
 
 <h1><%= title %></h1>
 
@@ -11,4 +11,4 @@
   <% }) %>
 </div>
 
-<% include ../footer %>
+<%- include('../footer') -%>
diff --git a/examples/route-separation/views/users/view.ejs b/examples/route-separation/views/users/view.ejs
index 696abc04504..457bd5399fd 100644
--- a/examples/route-separation/views/users/view.ejs
+++ b/examples/route-separation/views/users/view.ejs
@@ -1,4 +1,4 @@
-<% include ../header %>
+<%- include('../header') -%>
 
 <h1><%= user.name %></h1>
 
@@ -6,4 +6,4 @@
   <p>Email: <%= user.email %></p>
 </div>
 
-<% include ../footer %>
+<%- include('../footer') -%>
diff --git a/package.json b/package.json
index 6d5ce3742e1..0e78f80c5c7 100644
--- a/package.json
+++ b/package.json
@@ -64,7 +64,7 @@
     "connect-redis": "3.4.2",
     "cookie-parser": "~1.4.4",
     "cookie-session": "1.3.3",
-    "ejs": "2.7.2",
+    "ejs": "3.1.6",
     "eslint": "2.13.1",
     "express-session": "1.17.0",
     "hbs": "4.1.2",

From f490f785630eb494fa5326524a7de2118653fb23 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 11 Aug 2021 20:38:31 -0400
Subject: [PATCH 231/479] build: reduce npm output

---
 .github/workflows/ci.yml | 4 +++-
 appveyor.yml             | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ac9eaecc15..27a4b27014a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,7 +90,9 @@ jobs:
         dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
 
     - name: Configure npm
-      run: npm config set shrinkwrap false
+      run: |
+        npm config set loglevel error
+        npm config set shrinkwrap false
 
     - name: Install npm module(s) ${{ matrix.npm-i }}
       run: npm install --save-dev ${{ matrix.npm-i }}
diff --git a/appveyor.yml b/appveyor.yml
index 6ad289d83c9..4b3ed77bf25 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -23,7 +23,7 @@ install:
       catch { Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version) }
   # Configure npm
   - ps: |
-      # Skip updating shrinkwrap / lock
+      npm config set loglevel error
       npm config set shrinkwrap false
   # Remove all non-test dependencies
   - ps: |

From 821b7f0624dcd0f77327772f6a25b6d94f56976f Mon Sep 17 00:00:00 2001
From: Andrew Heaney <andrewheaney00@gmail.com>
Date: Thu, 5 Aug 2021 10:51:35 +0100
Subject: [PATCH 232/479] examples: fix typo in comment

closes #4667
---
 examples/web-service/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 0e2cbb7cde0..44520759bb9 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -8,7 +8,7 @@ var app = module.exports = express();
 
 // create an error with .status. we
 // can then use the property in our
-// custom error handler (Connect repects this prop as well)
+// custom error handler (Connect respects this prop as well)
 
 function error(status, msg) {
   var err = new Error(msg);

From f9a0560a9cb5ee2fcb901a6ed3710e9ffb6aa55c Mon Sep 17 00:00:00 2001
From: zhangky <iszhangky@163.com>
Date: Thu, 12 Aug 2021 14:35:46 +0800
Subject: [PATCH 233/479] docs: fix res.sendStatus/sendFile jsdoc comments

closes #4673
---
 lib/response.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index c0adc878f50..555e4f3d2d2 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -364,7 +364,7 @@ res.sendStatus = function sendStatus(statusCode) {
  *
  * Automatically sets the _Content-Type_ response header field.
  * The callback `callback(err)` is invoked when the transfer is complete
- * or when an error occurs. Be sure to check `res.sentHeader`
+ * or when an error occurs. Be sure to check `res.headersSent`
  * if you wish to attempt responding, as the header and some data
  * may have already been transferred.
  *
@@ -446,7 +446,7 @@ res.sendFile = function sendFile(path, options, callback) {
  *
  * Automatically sets the _Content-Type_ response header field.
  * The callback `callback(err)` is invoked when the transfer is complete
- * or when an error occurs. Be sure to check `res.sentHeader`
+ * or when an error occurs. Be sure to check `res.headersSent`
  * if you wish to attempt responding, as the header and some data
  * may have already been transferred.
  *

From d5a1cbee70cce4c1e4a60a3760e223aef0dc639a Mon Sep 17 00:00:00 2001
From: Aravind Nair <22199259+aravindvnair99@users.noreply.github.com>
Date: Fri, 23 Apr 2021 01:49:24 +0530
Subject: [PATCH 234/479] build: fix wrong Node.js 8.x in AppVeyor

closes #4574
---
 appveyor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/appveyor.yml b/appveyor.yml
index 4b3ed77bf25..5414c6a4201 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,7 +9,7 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.17"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.16"
+    - nodejs_version: "8.17"
     - nodejs_version: "9.11"
     - nodejs_version: "10.23"
     - nodejs_version: "11.15"

From 6f2afd3d8077bd15c8993868fc1a3c56de74a88b Mon Sep 17 00:00:00 2001
From: Aravind Nair <22199259+aravindvnair99@users.noreply.github.com>
Date: Fri, 23 Apr 2021 01:52:46 +0530
Subject: [PATCH 235/479] build: Node.js@10.24

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27a4b27014a..56cf6edacd5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,7 +72,7 @@ jobs:
           npm-i: mocha@7.2.0
 
         - name: Node.js 10.x
-          node-version: "10.23"
+          node-version: "10.24"
 
         - name: Node.js 11.x
           node-version: "11.15"
diff --git a/appveyor.yml b/appveyor.yml
index 5414c6a4201..b56a0445a25 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,7 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.17"
     - nodejs_version: "9.11"
-    - nodejs_version: "10.23"
+    - nodejs_version: "10.24"
     - nodejs_version: "11.15"
     - nodejs_version: "12.18"
 cache:

From 06d11755c99fe4c1cddf8b889a687448b568472d Mon Sep 17 00:00:00 2001
From: Aravind Nair <22199259+aravindvnair99@users.noreply.github.com>
Date: Fri, 23 Apr 2021 01:53:27 +0530
Subject: [PATCH 236/479] build: Node.js@12.22

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 56cf6edacd5..b73dd0cbf50 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,7 +78,7 @@ jobs:
           node-version: "11.15"
 
         - name: Node.js 12.x
-          node-version: "12.18"
+          node-version: "12.22"
 
     steps:
     - uses: actions/checkout@v2
diff --git a/appveyor.yml b/appveyor.yml
index b56a0445a25..79180000d82 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,7 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.24"
     - nodejs_version: "11.15"
-    - nodejs_version: "12.18"
+    - nodejs_version: "12.22"
 cache:
   - node_modules
 install:

From de081eb70fac96db567f88c540b4d487f0c97864 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Sep 2021 19:27:00 -0400
Subject: [PATCH 237/479] build: eslint@4.19.1

---
 .eslintrc.yml                      |  2 +-
 .github/workflows/ci.yml           | 13 +++++++++++++
 appveyor.yml                       |  6 ++++--
 examples/params/index.js           |  2 +-
 examples/resource/index.js         |  2 +-
 examples/route-middleware/index.js |  2 +-
 examples/web-service/index.js      |  2 +-
 lib/response.js                    |  2 +-
 package.json                       |  2 +-
 9 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index 5b11e9fd844..587169c5330 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -3,6 +3,6 @@ root: true
 rules:
   eol-last: error
   eqeqeq: [error, allow-null]
-  indent: [error, 2, { SwitchCase: 1 }]
+  indent: [error, 2, { MemberExpression: "off", SwitchCase: 1 }]
   no-trailing-spaces: error
   no-unused-vars: [error, { vars: all, args: none, ignoreRestSiblings: true }]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b73dd0cbf50..50291acb4d8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,6 +101,18 @@ jobs:
     - name: Remove non-test dependencies
       run: npm rm --silent --save-dev connect-redis
 
+    - name: Setup Node.js version-specific dependencies
+      shell: bash
+      run: |
+        # eslint for linting
+        # - remove on Node.js < 4
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 4 ]]; then
+          node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
+            grep -E '^eslint(-|$)' | \
+            sort -r | \
+            xargs -n1 npm rm --silent --save-dev
+        fi
+
     - name: Install Node.js dependencies
       run: npm install
 
@@ -117,6 +129,7 @@ jobs:
       run: npm run test-ci
 
     - name: Lint code
+      if: steps.list_env.outputs.eslint != ''
       run: npm run lint
 
     - name: Collect code coverage
diff --git a/appveyor.yml b/appveyor.yml
index 79180000d82..062d8ce539e 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -29,6 +29,10 @@ install:
   - ps: |
       # Remove example dependencies
       npm rm --silent --save-dev connect-redis
+      # Remove lint dependencies
+      cmd.exe /c "node -pe `"Object.keys(require('./package').devDependencies).join('\n')`"" | `
+        sls "^eslint(-|$)" | `
+        %{ npm rm --silent --save-dev $_ }
   # Setup Node.js version-specific dependencies
   - ps: |
       # mocha for testing
@@ -71,6 +75,4 @@ test_script:
       npm --version
   # Run test script
   - npm run test-ci
-  # Run linting
-  - npm run lint
 version: "{build}"
diff --git a/examples/params/index.js b/examples/params/index.js
index f918b5fd30d..5b57573d1e8 100644
--- a/examples/params/index.js
+++ b/examples/params/index.js
@@ -8,7 +8,7 @@ var app = module.exports = express();
 // Faux database
 
 var users = [
-    { name: 'tj' }
+  { name: 'tj' }
   , { name: 'tobi' }
   , { name: 'loki' }
   , { name: 'jane' }
diff --git a/examples/resource/index.js b/examples/resource/index.js
index 0c2a7a32079..b79ad923d27 100644
--- a/examples/resource/index.js
+++ b/examples/resource/index.js
@@ -26,7 +26,7 @@ app.resource = function(path, obj) {
 // Fake records
 
 var users = [
-    { name: 'tj' }
+  { name: 'tj' }
   , { name: 'ciaran' }
   , { name: 'aaron' }
   , { name: 'guillermo' }
diff --git a/examples/route-middleware/index.js b/examples/route-middleware/index.js
index 84407318870..e7a0901fa8f 100644
--- a/examples/route-middleware/index.js
+++ b/examples/route-middleware/index.js
@@ -15,7 +15,7 @@ var app = express();
 
 // Dummy users
 var users = [
-    { id: 0, name: 'tj', email: 'tj@vision-media.ca', role: 'member' }
+  { id: 0, name: 'tj', email: 'tj@vision-media.ca', role: 'member' }
   , { id: 1, name: 'ciaran', email: 'ciaranj@gmail.com', role: 'member' }
   , { id: 2, name: 'aaron', email: 'aaron.heckmann+github@gmail.com', role: 'admin' }
 ];
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 44520759bb9..5308fd9f0c3 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -55,7 +55,7 @@ var repos = [
 ];
 
 var users = [
-    { name: 'tobi' }
+  { name: 'tobi' }
   , { name: 'loki' }
   , { name: 'jane' }
 ];
diff --git a/lib/response.js b/lib/response.js
index 555e4f3d2d2..997e3a1a756 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -726,7 +726,7 @@ res.append = function append(field, val) {
     // concat the new and prev vals
     value = Array.isArray(prev) ? prev.concat(val)
       : Array.isArray(val) ? [prev].concat(val)
-      : [prev, val];
+        : [prev, val]
   }
 
   return this.set(field, value);
diff --git a/package.json b/package.json
index 0e78f80c5c7..6d4f0faca84 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
     "cookie-parser": "~1.4.4",
     "cookie-session": "1.3.3",
     "ejs": "3.1.6",
-    "eslint": "2.13.1",
+    "eslint": "4.19.1",
     "express-session": "1.17.0",
     "hbs": "4.1.2",
     "istanbul": "0.4.5",

From 313d54f0337a4d54fef9e2f178e032e7ce8e066c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Sep 2021 19:32:00 -0400
Subject: [PATCH 238/479] build: supertest@6.1.6

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6d4f0faca84..8557f4e3306 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "6.1.3",
+    "supertest": "6.1.6",
     "vhost": "~3.0.2"
   },
   "engines": {

From 61a23e801f2c3d54d5c1e91aa13b6cfa8c6d8937 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 5 Oct 2021 21:55:00 -0400
Subject: [PATCH 239/479] build: mocha@8.4.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8557f4e3306..b33568b4ffd 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "istanbul": "0.4.5",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "8.2.1",
+    "mocha": "8.4.0",
     "morgan": "1.9.1",
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",

From fc138c108f4deb602dbbdcf1128e55e4ba01efe3 Mon Sep 17 00:00:00 2001
From: 3imed-jaberi <imed_jebari@hotmail.fr>
Date: Fri, 3 Jul 2020 07:56:39 +0200
Subject: [PATCH 240/479] deps: proxy-addr@~2.0.6

closes #4340
---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6e62a6ddb85..c279c803bd4 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: proxy-addr@~2.0.6
+    - deps: ipaddr.js@1.9.1
+
 4.17.1 / 2019-05-25
 ===================
 
diff --git a/package.json b/package.json
index b33568b4ffd..470ed54520f 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.5",
+    "proxy-addr": "~2.0.6",
     "qs": "6.7.0",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.1.2",

From dab6ee58229f2af3680023021703e7ab5cf9c76f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Jos=C3=A9=20Arboleda?= <soyjuanarbol@gmail.com>
Date: Sat, 2 Oct 2021 19:33:41 -0500
Subject: [PATCH 241/479] tests: remove extraneous code from app.listen test

closes #4714
---
 test/app.listen.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/test/app.listen.js b/test/app.listen.js
index a78d16e4e1a..9d54ca5244d 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -5,10 +5,6 @@ describe('app.listen()', function(){
   it('should wrap with an HTTP server', function(done){
     var app = express();
 
-    app.del('/tobi', function(req, res){
-      res.end('deleted tobi!');
-    });
-
     var server = app.listen(9999, function(){
       server.close();
       done();

From 353348a83e6874db7ded27102e91e7b6cad7e89c Mon Sep 17 00:00:00 2001
From: Florian Brandt <fbrandt@sipgate.de>
Date: Thu, 20 Feb 2020 07:34:41 +0100
Subject: [PATCH 242/479] Fix typo in res.is JSDoc

closes #4192
---
 History.md     | 1 +
 lib/request.js | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c279c803bd4..9347f55f87b 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix typo in `res.is` JSDoc
   * deps: proxy-addr@~2.0.6
     - deps: ipaddr.js@1.9.1
 
diff --git a/lib/request.js b/lib/request.js
index a9400ef99de..3f1eeca6c1a 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -251,7 +251,7 @@ req.param = function param(name, defaultValue) {
 
 /**
  * Check if the incoming request contains the "Content-Type"
- * header field, and it contains the give mime `type`.
+ * header field, and it contains the given mime `type`.
  *
  * Examples:
  *

From a1dbb113779c45a10f56a910de1bc5f7e750eaea Mon Sep 17 00:00:00 2001
From: Kim <heeskim@ebay.com>
Date: Wed, 8 Jan 2020 10:56:45 +0900
Subject: [PATCH 243/479] Fix res.jsonp(obj, status) deprecation message

closes #4155
---
 History.md      | 1 +
 lib/response.js | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 9347f55f87b..52d444fdff0 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `res.jsonp(obj, status)` deprecation message
   * Fix typo in `res.is` JSDoc
   * deps: proxy-addr@~2.0.6
     - deps: ipaddr.js@1.9.1
diff --git a/lib/response.js b/lib/response.js
index 997e3a1a756..b3b9299ac18 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -284,9 +284,9 @@ res.jsonp = function jsonp(obj) {
 
   // allow status / body
   if (arguments.length === 2) {
-    // res.json(body, status) backwards compat
+    // res.jsonp(body, status) backwards compat
     if (typeof arguments[1] === 'number') {
-      deprecate('res.jsonp(obj, status): Use res.status(status).json(obj) instead');
+      deprecate('res.jsonp(obj, status): Use res.status(status).jsonp(obj) instead');
       this.statusCode = arguments[1];
     } else {
       deprecate('res.jsonp(status, obj): Use res.status(status).jsonp(obj) instead');

From 99a369f3d51bafcf0c09657250067249f19d04f5 Mon Sep 17 00:00:00 2001
From: Ivan Derevianko <drussilla7@gmail.com>
Date: Thu, 5 Mar 2020 12:00:08 +0100
Subject: [PATCH 244/479] Fix incorrect middleware execution with unanchored
 RegExps

fixes #4204
closes #4205
---
 History.md          |  1 +
 lib/router/index.js |  6 ++++++
 test/app.router.js  | 29 +++++++++++++++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/History.md b/History.md
index 52d444fdff0..d52d1a67e3f 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix incorrect middleware execution with unanchored `RegExp`s
   * Fix `res.jsonp(obj, status)` deprecation message
   * Fix typo in `res.is` JSDoc
   * deps: proxy-addr@~2.0.6
diff --git a/lib/router/index.js b/lib/router/index.js
index 69e6d3800af..fbe94acdb47 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -287,6 +287,12 @@ proto.handle = function handle(req, res, out) {
 
   function trim_prefix(layer, layerError, layerPath, path) {
     if (layerPath.length !== 0) {
+      // Validate path is a prefix match
+      if (layerPath !== path.substr(0, layerPath.length)) {
+        next(layerError)
+        return
+      }
+
       // Validate path breaks on a path separator
       var c = path[layerPath.length]
       if (c && c !== '/' && c !== '.') return next(layerError)
diff --git a/test/app.router.js b/test/app.router.js
index 5a31b5fb90c..a4fe57cc2bb 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -186,6 +186,35 @@ describe('app.router', function(){
       .get('/user/10/edit')
       .expect('editing user 10', done);
     })
+
+    it('should ensure regexp matches path prefix', function (done) {
+      var app = express()
+      var p = []
+
+      app.use(/\/api.*/, function (req, res, next) {
+        p.push('a')
+        next()
+      })
+      app.use(/api/, function (req, res, next) {
+        p.push('b')
+        next()
+      })
+      app.use(/\/test/, function (req, res, next) {
+        p.push('c')
+        next()
+      })
+      app.use(function (req, res) {
+        res.end()
+      })
+
+      request(app)
+        .get('/test/api/1234')
+        .expect(200, function (err) {
+          if (err) return done(err)
+          assert.deepEqual(p, ['c'])
+          done()
+        })
+    })
   })
 
   describe('case sensitivity', function(){

From 519126d732c65e68fbdc7575f601ee5b6e9972d8 Mon Sep 17 00:00:00 2001
From: 3imed-jaberi <imed_jebari@hotmail.fr>
Date: Fri, 3 Jul 2020 05:56:52 +0200
Subject: [PATCH 245/479] deps: cookie@0.4.1

closes #4337
---
 History.md         |  2 ++
 package.json       |  2 +-
 test/res.cookie.js | 13 +++++++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d52d1a67e3f..3dfd2c05de6 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * Fix incorrect middleware execution with unanchored `RegExp`s
   * Fix `res.jsonp(obj, status)` deprecation message
   * Fix typo in `res.is` JSDoc
+  * deps: cookie@0.4.1
+    - Fix `maxAge` option to reject invalid values
   * deps: proxy-addr@~2.0.6
     - deps: ipaddr.js@1.9.1
 
diff --git a/package.json b/package.json
index 470ed54520f..8e3c4dc3adf 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "body-parser": "1.19.0",
     "content-disposition": "0.5.3",
     "content-type": "~1.0.4",
-    "cookie": "0.4.0",
+    "cookie": "0.4.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~1.1.2",
diff --git a/test/res.cookie.js b/test/res.cookie.js
index 271a0969e62..d8e6b7ca859 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -115,6 +115,19 @@ describe('res', function(){
         .get('/')
         .expect(200, optionsCopy, done)
       })
+
+      it('should throw an error with invalid maxAge', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { maxAge: 'foobar' })
+          res.end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(500, /option maxAge is invalid/, done)
+      })
     })
 
     describe('signed', function(){

From 1b2f3a06982cf4d51482dd79447b66315687b287 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Nov 2021 23:53:10 -0500
Subject: [PATCH 246/479] tests: fix up primitive tests for res.jsonp

---
 test/res.jsonp.js | 103 +++++++++++++++++++++-------------------------
 1 file changed, 46 insertions(+), 57 deletions(-)

diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 40dba100f92..dd9eb5af7a8 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -156,89 +156,78 @@ describe('res', function(){
       .expect(200, /cb\(\{"hello":"world"\}\);$/, done);
     })
 
-    describe('when given primitives', function(){
-      it('should respond with json', function(done){
-        var app = express();
+    describe('when given null', function () {
+      it('should invoke callback with null', function (done) {
+        var app = express()
 
-        app.use(function(req, res){
-          res.jsonp(null);
-        });
+        app.use(function (req, res) {
+          res.jsonp(null)
+        })
 
         request(app)
-        .get('/')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200, 'null', done)
+          .get('/?callback=cb')
+          .expect('Content-Type', 'text/javascript; charset=utf-8')
+          .expect(200, /cb\(null\)/, done)
       })
     })
 
-    describe('when given an array', function(){
-      it('should respond with json', function(done){
-        var app = express();
+    describe('when given a string', function () {
+      it('should invoke callback with a string', function (done) {
+        var app = express()
 
-        app.use(function(req, res){
-          res.jsonp(['foo', 'bar', 'baz']);
-        });
+        app.use(function (req, res) {
+          res.jsonp('tobi')
+        })
 
         request(app)
-        .get('/')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200, '["foo","bar","baz"]', done)
+          .get('/?callback=cb')
+          .expect('Content-Type', 'text/javascript; charset=utf-8')
+          .expect(200, /cb\("tobi"\)/, done)
       })
     })
 
-    describe('when given an object', function(){
-      it('should respond with json', function(done){
-        var app = express();
+    describe('when given a number', function () {
+      it('should invoke callback with a number', function (done) {
+        var app = express()
 
-        app.use(function(req, res){
-          res.jsonp({ name: 'tobi' });
-        });
+        app.use(function (req, res) {
+          res.jsonp(42)
+        })
 
         request(app)
-        .get('/')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200, '{"name":"tobi"}', done)
+          .get('/?callback=cb')
+          .expect('Content-Type', 'text/javascript; charset=utf-8')
+          .expect(200, /cb\(42\)/, done)
       })
     })
 
-    describe('when given primitives', function(){
-      it('should respond with json for null', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          res.jsonp(null);
-        });
-
-        request(app)
-        .get('/')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200, 'null', done)
-      })
-
-      it('should respond with json for Number', function(done){
-        var app = express();
+    describe('when given an array', function () {
+      it('should invoke callback with an array', function (done) {
+        var app = express()
 
-        app.use(function(req, res){
-          res.jsonp(300);
-        });
+        app.use(function (req, res) {
+          res.jsonp(['foo', 'bar', 'baz'])
+        })
 
         request(app)
-        .get('/')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200, '300', done)
+          .get('/?callback=cb')
+          .expect('Content-Type', 'text/javascript; charset=utf-8')
+          .expect(200, /cb\(\["foo","bar","baz"\]\)/, done)
       })
+    })
 
-      it('should respond with json for String', function(done){
-        var app = express();
+    describe('when given an object', function () {
+      it('should invoke callback with an object', function (done) {
+        var app = express()
 
-        app.use(function(req, res){
-          res.jsonp('str');
-        });
+        app.use(function (req, res) {
+          res.jsonp({ name: 'tobi' })
+        })
 
         request(app)
-        .get('/')
-        .expect('Content-Type', 'application/json; charset=utf-8')
-        .expect(200, '"str"', done)
+          .get('/?callback=cb')
+          .expect('Content-Type', 'text/javascript; charset=utf-8')
+          .expect(200, /cb\(\{"name":"tobi"\}\)/, done)
       })
     })
 

From 9dd0e7afdb6d022e18add1e009c4e3a66258c1fa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Nov 2021 23:58:17 -0500
Subject: [PATCH 247/479] Fix handling of undefined in res.jsonp

---
 History.md        |  1 +
 lib/response.js   | 13 +++++++++----
 test/res.jsonp.js | 15 +++++++++++++++
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 3dfd2c05de6..8acb439c6de 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix handling of `undefined` in `res.jsonp`
   * Fix incorrect middleware execution with unanchored `RegExp`s
   * Fix `res.jsonp(obj, status)` deprecation message
   * Fix typo in `res.is` JSDoc
diff --git a/lib/response.js b/lib/response.js
index b3b9299ac18..f08a697ace9 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -322,10 +322,15 @@ res.jsonp = function jsonp(obj) {
     // restrict callback charset
     callback = callback.replace(/[^\[\]\w$.]/g, '');
 
-    // replace chars not allowed in JavaScript that are in JSON
-    body = body
-      .replace(/\u2028/g, '\\u2028')
-      .replace(/\u2029/g, '\\u2029');
+    if (body === undefined) {
+      // empty argument
+      body = ''
+    } else if (typeof body === 'string') {
+      // replace chars not allowed in JavaScript that are in JSON
+      body = body
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029')
+    }
 
     // the /**/ is a specific security mitigation for "Rosetta Flash JSONP abuse"
     // the typeof check is just to reduce client error noise
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index dd9eb5af7a8..1a4b9a0ccce 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -156,6 +156,21 @@ describe('res', function(){
       .expect(200, /cb\(\{"hello":"world"\}\);$/, done);
     })
 
+    describe('when given undefined', function () {
+      it('should invoke callback with no arguments', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.jsonp(undefined)
+        })
+
+        request(app)
+          .get('/?callback=cb')
+          .expect('Content-Type', 'text/javascript; charset=utf-8')
+          .expect(200, /cb\(\)/, done)
+      })
+    })
+
     describe('when given null', function () {
       it('should invoke callback with null', function (done) {
         var app = express()

From f275e87dff1aaef86080e6931888de4968585fd8 Mon Sep 17 00:00:00 2001
From: drewm <drew.mclellan@snyk.io>
Date: Wed, 3 Nov 2021 10:58:25 +0000
Subject: [PATCH 248/479] Fix handling of undefined when "json escape" is
 enabled

closes #4744
---
 History.md        |  1 +
 lib/response.js   |  2 +-
 test/res.json.js  | 15 +++++++++++++++
 test/res.jsonp.js | 15 +++++++++++++++
 4 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 8acb439c6de..34c5a17e5db 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix handling of `undefined` in `res.jsonp`
+  * Fix handling of `undefined` when `"json escape"` is enabled
   * Fix incorrect middleware execution with unanchored `RegExp`s
   * Fix `res.jsonp(obj, status)` deprecation message
   * Fix typo in `res.is` JSDoc
diff --git a/lib/response.js b/lib/response.js
index f08a697ace9..48239a475ac 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -1127,7 +1127,7 @@ function stringify (value, replacer, spaces, escape) {
     ? JSON.stringify(value, replacer, spaces)
     : JSON.stringify(value);
 
-  if (escape) {
+  if (escape && typeof json === 'string') {
     json = json.replace(/[<>&]/g, function (c) {
       switch (c.charCodeAt(0)) {
         case 0x3c:
diff --git a/test/res.json.js b/test/res.json.js
index a82a127546e..59227a830b8 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -122,6 +122,21 @@ describe('res', function(){
         .expect('Content-Type', 'application/json; charset=utf-8')
         .expect(200, '{"\\u0026":"\\u003cscript\\u003e"}', done)
       })
+
+      it('should not break undefined escape', function (done) {
+        var app = express()
+
+        app.enable('json escape')
+
+        app.use(function (req, res) {
+          res.json(undefined)
+        })
+
+        request(app)
+          .get('/')
+          .expect('Content-Type', 'application/json; charset=utf-8')
+          .expect(200, '', done)
+      })
     })
 
     describe('"json replacer" setting', function(){
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 1a4b9a0ccce..3444d5138b5 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -266,6 +266,21 @@ describe('res', function(){
         .expect('Content-Type', 'text/javascript; charset=utf-8')
         .expect(200, /foo\({"\\u0026":"\\u2028\\u003cscript\\u003e\\u2029"}\)/, done)
       })
+
+      it('should not break undefined escape', function (done) {
+        var app = express()
+
+        app.enable('json escape')
+
+        app.use(function (req, res) {
+          res.jsonp(undefined)
+        })
+
+        request(app)
+          .get('/?callback=cb')
+          .expect('Content-Type', 'text/javascript; charset=utf-8')
+          .expect(200, /cb\(\)/, done)
+      })
     })
 
     describe('"json replacer" setting', function(){

From aaa9690bcfca426efde7092ff72fa15cb9bf86a9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Nov 2021 16:16:04 -0500
Subject: [PATCH 249/479] deps: proxy-addr@~2.0.7

---
 History.md   | 4 +++-
 package.json | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 34c5a17e5db..fe2952e6484 100644
--- a/History.md
+++ b/History.md
@@ -8,7 +8,9 @@ unreleased
   * Fix typo in `res.is` JSDoc
   * deps: cookie@0.4.1
     - Fix `maxAge` option to reject invalid values
-  * deps: proxy-addr@~2.0.6
+  * deps: proxy-addr@~2.0.7
+    - Use `req.socket` over deprecated `req.connection`
+    - deps: forwarded@0.2.0
     - deps: ipaddr.js@1.9.1
 
 4.17.1 / 2019-05-25
diff --git a/package.json b/package.json
index 8e3c4dc3adf..1743c05205b 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.6",
+    "proxy-addr": "~2.0.7",
     "qs": "6.7.0",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.1.2",

From e242796eb343c1e1e17c963dfb09d751a85b3c68 Mon Sep 17 00:00:00 2001
From: Andy <yuanjiang@outlook.com>
Date: Sat, 27 Nov 2021 17:46:11 +0900
Subject: [PATCH 250/479] tests: fix test in app.head

closes #4765
---
 test/app.head.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/app.head.js b/test/app.head.js
index ed8499ce293..b417ca0c921 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -26,7 +26,7 @@ describe('HEAD', function(){
     });
 
     request(app)
-    .get('/tobi')
+    .head('/tobi')
     .expect(200, function(err, res){
       if (err) return done(err);
       var headers = res.headers;

From 59d695c447f6b7540f9c75afa5693e5fe436bba1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Dec 2021 15:47:40 -0500
Subject: [PATCH 251/479] build: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 1743c05205b..86cc2490331 100644
--- a/package.json
+++ b/package.json
@@ -62,18 +62,18 @@
   "devDependencies": {
     "after": "0.8.2",
     "connect-redis": "3.4.2",
-    "cookie-parser": "~1.4.4",
-    "cookie-session": "1.3.3",
+    "cookie-parser": "1.4.6",
+    "cookie-session": "1.4.0",
     "ejs": "3.1.6",
     "eslint": "4.19.1",
     "express-session": "1.17.0",
-    "hbs": "4.1.2",
+    "hbs": "4.2.0",
     "istanbul": "0.4.5",
     "marked": "0.7.0",
     "method-override": "3.0.0",
     "mocha": "8.4.0",
-    "morgan": "1.9.1",
-    "multiparty": "4.2.1",
+    "morgan": "1.10.0",
+    "multiparty": "4.2.2",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
     "supertest": "6.1.6",

From b8d59d5c9855238950dd799f7799ea3283787e9f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Dec 2021 17:56:56 -0500
Subject: [PATCH 252/479] deps: safe-buffer@5.2.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fe2952e6484..69e7695678c 100644
--- a/History.md
+++ b/History.md
@@ -12,6 +12,7 @@ unreleased
     - Use `req.socket` over deprecated `req.connection`
     - deps: forwarded@0.2.0
     - deps: ipaddr.js@1.9.1
+  * deps: safe-buffer@5.2.1
 
 4.17.1 / 2019-05-25
 ===================
diff --git a/package.json b/package.json
index 86cc2490331..a40f44e9a69 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "proxy-addr": "~2.0.7",
     "qs": "6.7.0",
     "range-parser": "~1.2.1",
-    "safe-buffer": "5.1.2",
+    "safe-buffer": "5.2.1",
     "send": "0.17.1",
     "serve-static": "1.14.1",
     "setprototypeof": "1.1.1",

From 96850e872a7f0b88ae44fb7b09ebb3bee8257816 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Dec 2021 17:58:03 -0500
Subject: [PATCH 253/479] deps: content-disposition@0.5.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 69e7695678c..21cf1b426c4 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,8 @@ unreleased
   * Fix incorrect middleware execution with unanchored `RegExp`s
   * Fix `res.jsonp(obj, status)` deprecation message
   * Fix typo in `res.is` JSDoc
+  * deps: content-disposition@0.5.4
+    - deps: safe-buffer@5.2.1
   * deps: cookie@0.4.1
     - Fix `maxAge` option to reject invalid values
   * deps: proxy-addr@~2.0.7
diff --git a/package.json b/package.json
index a40f44e9a69..024c78d31d3 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "accepts": "~1.3.7",
     "array-flatten": "1.1.1",
     "body-parser": "1.19.0",
-    "content-disposition": "0.5.3",
+    "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
     "cookie": "0.4.1",
     "cookie-signature": "1.0.6",

From c2e23ece2e03a70fdb1005195dc239fb4e48bf22 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 11 Dec 2021 03:45:46 -0500
Subject: [PATCH 254/479] deps: body-parser@1.19.1

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 21cf1b426c4..dd5ea809391 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,13 @@ unreleased
   * Fix incorrect middleware execution with unanchored `RegExp`s
   * Fix `res.jsonp(obj, status)` deprecation message
   * Fix typo in `res.is` JSDoc
+  * deps: body-parser@1.19.1
+    - deps: bytes@3.1.1
+    - deps: http-errors@1.8.1
+    - deps: qs@6.9.6
+    - deps: raw-body@2.4.2
+    - deps: safe-buffer@5.2.1
+    - deps: type-is@~1.6.18
   * deps: content-disposition@0.5.4
     - deps: safe-buffer@5.2.1
   * deps: cookie@0.4.1
diff --git a/package.json b/package.json
index 024c78d31d3..9f294a66b13 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
   "dependencies": {
     "accepts": "~1.3.7",
     "array-flatten": "1.1.1",
-    "body-parser": "1.19.0",
+    "body-parser": "1.19.1",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
     "cookie": "0.4.1",

From db05a741f0fbb28427c069c73f3c17d504c1812a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 11 Dec 2021 20:19:38 -0500
Subject: [PATCH 255/479] deps: send@0.17.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index dd5ea809391..d4c013c1037 100644
--- a/History.md
+++ b/History.md
@@ -22,6 +22,10 @@ unreleased
     - deps: forwarded@0.2.0
     - deps: ipaddr.js@1.9.1
   * deps: safe-buffer@5.2.1
+  * deps: send@0.17.2
+    - deps: http-errors@1.8.1
+    - deps: ms@2.1.3
+    - pref: ignore empty http tokens
 
 4.17.1 / 2019-05-25
 ===================
diff --git a/package.json b/package.json
index 9f294a66b13..791b76a4550 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "qs": "6.7.0",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
-    "send": "0.17.1",
+    "send": "0.17.2",
     "serve-static": "1.14.1",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",

From a75e4707b96e7c2e3031c55e06f53ec09cc05e7d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 15 Dec 2021 20:45:56 -0500
Subject: [PATCH 256/479] docs: add note about security report location

---
 Security.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Security.md b/Security.md
index cbc5f16cde5..858dfffc5bc 100644
--- a/Security.md
+++ b/Security.md
@@ -16,6 +16,10 @@ contributions.
 
 Report security bugs by emailing the lead maintainer in the Readme.md file.
 
+To ensure the timely response to your report, please ensure that the entirety
+of the report is contained within the email body and not solely behind a web
+link or an attachment.
+
 The lead maintainer will acknowledge your email within 48 hours, and will send a
 more detailed response within 48 hours indicating the next steps in handling
 your report. After the initial reply to your report, the security team will

From 6660649f1bdc5125915b48f9eac3f9c8a23f1f84 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 15 Dec 2021 20:48:00 -0500
Subject: [PATCH 257/479] deps: qs@6.9.6

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d4c013c1037..a709b9c201b 100644
--- a/History.md
+++ b/History.md
@@ -21,6 +21,7 @@ unreleased
     - Use `req.socket` over deprecated `req.connection`
     - deps: forwarded@0.2.0
     - deps: ipaddr.js@1.9.1
+  * deps: qs@6.9.6
   * deps: safe-buffer@5.2.1
   * deps: send@0.17.2
     - deps: http-errors@1.8.1
diff --git a/package.json b/package.json
index 791b76a4550..7a5cb8b9606 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.7",
-    "qs": "6.7.0",
+    "qs": "6.9.6",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
     "send": "0.17.2",

From 3bb6d96ba9f386d8b328605ba762656cc759104b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 15 Dec 2021 21:06:33 -0500
Subject: [PATCH 258/479] examples: demonstrate sub directory download

---
 examples/downloads/files/notes/groceries.txt |  3 +++
 examples/downloads/index.js                  | 11 ++++++-----
 test/acceptance/downloads.js                 |  9 +++++++++
 3 files changed, 18 insertions(+), 5 deletions(-)
 create mode 100644 examples/downloads/files/notes/groceries.txt

diff --git a/examples/downloads/files/notes/groceries.txt b/examples/downloads/files/notes/groceries.txt
new file mode 100644
index 00000000000..fb43877709c
--- /dev/null
+++ b/examples/downloads/files/notes/groceries.txt
@@ -0,0 +1,3 @@
+* milk
+* eggs
+* bread
diff --git a/examples/downloads/index.js b/examples/downloads/index.js
index 5f0772697c1..9321f3bf951 100644
--- a/examples/downloads/index.js
+++ b/examples/downloads/index.js
@@ -7,11 +7,12 @@ var path = require('path');
 var app = module.exports = express();
 
 app.get('/', function(req, res){
-  res.send('<ul>'
-    + '<li>Download <a href="/files/amazing.txt">amazing.txt</a>.</li>'
-    + '<li>Download <a href="/files/missing.txt">missing.txt</a>.</li>'
-    + '<li>Download <a href="/files/CCTV大赛上海分赛区.txt">CCTV大赛上海分赛区.txt</a>.</li>'
-    + '</ul>');
+  res.send('<ul>' +
+    '<li>Download <a href="/files/notes/groceries.txt">notes/groceries.txt</a>.</li>' +
+    '<li>Download <a href="/files/amazing.txt">amazing.txt</a>.</li>' +
+    '<li>Download <a href="/files/missing.txt">missing.txt</a>.</li>' +
+    '<li>Download <a href="/files/CCTV大赛上海分赛区.txt">CCTV大赛上海分赛区.txt</a>.</li>' +
+    '</ul>')
 });
 
 // /files/* is accessed via req.params[0]
diff --git a/test/acceptance/downloads.js b/test/acceptance/downloads.js
index a0aa7b75d9f..ae44388354f 100644
--- a/test/acceptance/downloads.js
+++ b/test/acceptance/downloads.js
@@ -11,6 +11,15 @@ describe('downloads', function(){
     })
   })
 
+  describe('GET /files/notes/groceries.txt', function () {
+    it('should have a download header', function (done) {
+      request(app)
+        .get('/files/notes/groceries.txt')
+        .expect('Content-Disposition', 'attachment; filename="groceries.txt"')
+        .expect(200, done)
+    })
+  })
+
   describe('GET /files/amazing.txt', function(){
     it('should have a download header', function(done){
       request(app)

From cbe25d66b3ad397c52c6a66b77f18b483f8ed47e Mon Sep 17 00:00:00 2001
From: Wes Todd <wtodd@netflix.com>
Date: Wed, 17 Jul 2019 22:09:17 -0700
Subject: [PATCH 259/479] deps: setprototypeof@1.2.0

closes #4011
---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a709b9c201b..fd4ea7a6fee 100644
--- a/History.md
+++ b/History.md
@@ -27,6 +27,7 @@ unreleased
     - deps: http-errors@1.8.1
     - deps: ms@2.1.3
     - pref: ignore empty http tokens
+  * deps: setprototypeof@1.2.0
 
 4.17.1 / 2019-05-25
 ===================
diff --git a/package.json b/package.json
index 7a5cb8b9606..180bfb824be 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "safe-buffer": "5.2.1",
     "send": "0.17.2",
     "serve-static": "1.14.1",
-    "setprototypeof": "1.1.1",
+    "setprototypeof": "1.2.0",
     "statuses": "~1.5.0",
     "type-is": "~1.6.18",
     "utils-merge": "1.0.1",

From 6fe271e8aadfe3e67bd5b01714cc0f18bc27914d Mon Sep 17 00:00:00 2001
From: 3imed-jaberi <imed_jebari@hotmail.fr>
Date: Fri, 3 Jul 2020 07:42:21 +0200
Subject: [PATCH 260/479] build: support Node.js 13.x

---
 .github/workflows/ci.yml | 4 ++++
 appveyor.yml             | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 50291acb4d8..b3d60d803ae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,6 +25,7 @@ jobs:
         - Node.js 10.x
         - Node.js 11.x
         - Node.js 12.x
+        - Node.js 13.x
 
         include:
         - name: Node.js 0.10
@@ -80,6 +81,9 @@ jobs:
         - name: Node.js 12.x
           node-version: "12.22"
 
+        - name: Node.js 13.x
+          node-version: "13.14"
+
     steps:
     - uses: actions/checkout@v2
 
diff --git a/appveyor.yml b/appveyor.yml
index 062d8ce539e..eacac34fe18 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -14,6 +14,7 @@ environment:
     - nodejs_version: "10.24"
     - nodejs_version: "11.15"
     - nodejs_version: "12.22"
+    - nodejs_version: "13.14"
 cache:
   - node_modules
 install:

From a33266a206f3d259007a43a6b0235978ec98e8ad Mon Sep 17 00:00:00 2001
From: 3imed-jaberi <imed_jebari@hotmail.fr>
Date: Tue, 12 Jan 2021 18:06:17 +0100
Subject: [PATCH 261/479] build: support Node.js 14.x

---
 .github/workflows/ci.yml | 4 ++++
 appveyor.yml             | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b3d60d803ae..a5946adfc3b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,6 +26,7 @@ jobs:
         - Node.js 11.x
         - Node.js 12.x
         - Node.js 13.x
+        - Node.js 14.x
 
         include:
         - name: Node.js 0.10
@@ -84,6 +85,9 @@ jobs:
         - name: Node.js 13.x
           node-version: "13.14"
 
+        - name: Node.js 14.x
+          node-version: "14.18"
+
     steps:
     - uses: actions/checkout@v2
 
diff --git a/appveyor.yml b/appveyor.yml
index eacac34fe18..de59d67278a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -15,6 +15,7 @@ environment:
     - nodejs_version: "11.15"
     - nodejs_version: "12.22"
     - nodejs_version: "13.14"
+    - nodejs_version: "14.18"
 cache:
   - node_modules
 install:

From a24f27aba7e61ed5a22ba37ab4260fba1b2151f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Dec 2021 12:54:18 -0500
Subject: [PATCH 262/479] deps: serve-static@1.14.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fd4ea7a6fee..ce7f514cdad 100644
--- a/History.md
+++ b/History.md
@@ -27,6 +27,8 @@ unreleased
     - deps: http-errors@1.8.1
     - deps: ms@2.1.3
     - pref: ignore empty http tokens
+  * deps: serve-static@1.14.2
+    - deps: send@0.17.2
   * deps: setprototypeof@1.2.0
 
 4.17.1 / 2019-05-25
diff --git a/package.json b/package.json
index 180bfb824be..f657301bb3f 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
     "send": "0.17.2",
-    "serve-static": "1.14.1",
+    "serve-static": "1.14.2",
     "setprototypeof": "1.2.0",
     "statuses": "~1.5.0",
     "type-is": "~1.6.18",

From 21cf522dcd94ac2af6898ca81df02b373362bf24 Mon Sep 17 00:00:00 2001
From: Aalaap Ghag <aalaap@gmail.com>
Date: Sun, 29 Nov 2020 09:41:16 +0530
Subject: [PATCH 263/479] examples: improve 404 message wording

closes #4471
---
 examples/web-service/index.js  | 2 +-
 test/acceptance/web-service.js | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 5308fd9f0c3..3685619d105 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -105,7 +105,7 @@ app.use(function(err, req, res, next){
 // invoke next() and do not respond.
 app.use(function(req, res){
   res.status(404);
-  res.send({ error: "Lame, can't find that" });
+  res.send({ error: "Sorry, can't find that" })
 });
 
 /* istanbul ignore next */
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index fa2c10bfdb4..2e37b48c8ca 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -97,9 +97,9 @@ describe('web-service', function(){
   describe('when requesting an invalid route', function(){
     it('should respond with 404 json', function(done){
       request(app)
-      .get('/api/something?api-key=bar')
-      .expect('Content-Type', /json/)
-      .expect(404, '{"error":"Lame, can\'t find that"}', done)
+        .get('/api/something?api-key=bar')
+        .expect('Content-Type', /json/)
+        .expect(404, '{"error":"Sorry, can\'t find that"}', done)
     })
   })
 })

From c8a42006b84d56bc5d1dd7e1e9a6ad00c1a1d389 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Dec 2021 21:39:43 -0500
Subject: [PATCH 264/479] build: mocha@9.1.3

---
 .github/workflows/ci.yml | 2 ++
 appveyor.yml             | 3 +++
 package.json             | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a5946adfc3b..ba54ef9ee76 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -75,9 +75,11 @@ jobs:
 
         - name: Node.js 10.x
           node-version: "10.24"
+          npm-i: mocha@8.4.0
 
         - name: Node.js 11.x
           node-version: "11.15"
+          npm-i: mocha@8.4.0
 
         - name: Node.js 12.x
           node-version: "12.22"
diff --git a/appveyor.yml b/appveyor.yml
index de59d67278a..785c799e8fe 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -42,6 +42,7 @@ install:
       # - use 5.x for Node.js < 6
       # - use 6.x for Node.js < 8
       # - use 7.x for Node.js < 10
+      # - use 8.x for Node.js < 12
       if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev mocha@3.5.3
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
@@ -50,6 +51,8 @@ install:
         npm install --silent --save-dev mocha@6.2.2
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 10) {
         npm install --silent --save-dev mocha@7.2.0
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 12) {
+        npm install --silent --save-dev mocha@8.4.0
       }
   - ps: |
       # supertest for http calls
diff --git a/package.json b/package.json
index f657301bb3f..7122cb21fe0 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "istanbul": "0.4.5",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "8.4.0",
+    "mocha": "9.1.3",
     "morgan": "1.10.0",
     "multiparty": "4.2.2",
     "pbkdf2-password": "1.2.1",

From b35773cf19127e3392f5f908b3a4bea1410fd30a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Dec 2021 21:44:26 -0500
Subject: [PATCH 265/479] build: eslint@7.32.0

---
 .github/workflows/ci.yml | 4 ++--
 package.json             | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba54ef9ee76..80248fab691 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,8 +115,8 @@ jobs:
       shell: bash
       run: |
         # eslint for linting
-        # - remove on Node.js < 4
-        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 4 ]]; then
+        # - remove on Node.js < 10
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
           node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
             grep -E '^eslint(-|$)' | \
             sort -r | \
diff --git a/package.json b/package.json
index 7122cb21fe0..73835f61445 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
     "cookie-parser": "1.4.6",
     "cookie-session": "1.4.0",
     "ejs": "3.1.6",
-    "eslint": "4.19.1",
+    "eslint": "7.32.0",
     "express-session": "1.17.0",
     "hbs": "4.2.0",
     "istanbul": "0.4.5",

From eee93a2760de89e8103737c2d097f20464a3c3f0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Dec 2021 21:47:10 -0500
Subject: [PATCH 266/479] build: update example dependencies

---
 package.json                       | 4 ++--
 test/acceptance/cookie-sessions.js | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 73835f61445..d692007a8f8 100644
--- a/package.json
+++ b/package.json
@@ -63,10 +63,10 @@
     "after": "0.8.2",
     "connect-redis": "3.4.2",
     "cookie-parser": "1.4.6",
-    "cookie-session": "1.4.0",
+    "cookie-session": "2.0.0",
     "ejs": "3.1.6",
     "eslint": "7.32.0",
-    "express-session": "1.17.0",
+    "express-session": "1.17.2",
     "hbs": "4.2.0",
     "istanbul": "0.4.5",
     "marked": "0.7.0",
diff --git a/test/acceptance/cookie-sessions.js b/test/acceptance/cookie-sessions.js
index d438cfe6d5d..e83c8e419da 100644
--- a/test/acceptance/cookie-sessions.js
+++ b/test/acceptance/cookie-sessions.js
@@ -13,7 +13,7 @@ describe('cookie-sessions', function () {
     it('should set a session cookie', function (done) {
       request(app)
       .get('/')
-      .expect('Set-Cookie', /express:sess=/)
+      .expect('Set-Cookie', /session=/)
       .expect(200, done)
     })
 

From ea537d907d61dc693587fd41aab024e9df2e14b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Dec 2021 22:40:49 -0500
Subject: [PATCH 267/479] 4.17.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index ce7f514cdad..41cacce786f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.17.2 / 2021-12-16
+===================
 
   * Fix handling of `undefined` in `res.jsonp`
   * Fix handling of `undefined` when `"json escape"` is enabled
diff --git a/package.json b/package.json
index d692007a8f8..b5db8140944 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.17.1",
+  "version": "4.17.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From c221b8596e5ff783bbedadb2d7696f90817b0c85 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Jan 2022 19:02:58 -0500
Subject: [PATCH 268/479] build: mocha@9.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b5db8140944..ebb7425d9ac 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "istanbul": "0.4.5",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "9.1.3",
+    "mocha": "9.2.0",
     "morgan": "1.10.0",
     "multiparty": "4.2.2",
     "pbkdf2-password": "1.2.1",

From 69997cbdbef83c5cf1a419d6e86519af432d68a8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 00:44:28 -0500
Subject: [PATCH 269/479] examples: fix error handling in auth example

---
 examples/auth/index.js  |  7 ++++---
 test/acceptance/auth.js | 17 ++++++++++++++++-
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/examples/auth/index.js b/examples/auth/index.js
index b8e854300cb..70110891ad5 100644
--- a/examples/auth/index.js
+++ b/examples/auth/index.js
@@ -59,14 +59,14 @@ function authenticate(name, pass, fn) {
   if (!module.parent) console.log('authenticating %s:%s', name, pass);
   var user = users[name];
   // query the db for the given username
-  if (!user) return fn(new Error('cannot find user'));
+  if (!user) return fn(null, null)
   // apply the same algorithm to the POSTed password, applying
   // the hash against the pass / salt, if there is a match we
   // found the user
   hash({ password: pass, salt: user.salt }, function (err, pass, salt, hash) {
     if (err) return fn(err);
     if (hash === user.hash) return fn(null, user)
-    fn(new Error('invalid password'));
+    fn(null, null)
   });
 }
 
@@ -99,8 +99,9 @@ app.get('/login', function(req, res){
   res.render('login');
 });
 
-app.post('/login', function(req, res){
+app.post('/login', function (req, res, next) {
   authenticate(req.body.username, req.body.password, function(err, user){
+    if (err) return next(err)
     if (user) {
       // Regenerate session when signing in
       // to prevent fixation
diff --git a/test/acceptance/auth.js b/test/acceptance/auth.js
index 9a36ea45feb..d7838755a08 100644
--- a/test/acceptance/auth.js
+++ b/test/acceptance/auth.js
@@ -22,7 +22,7 @@ describe('auth', function(){
       .expect(200, /<form/, done)
     })
 
-    it('should display login error', function(done){
+    it('should display login error for bad user', function (done) {
       request(app)
       .post('/login')
       .type('urlencoded')
@@ -36,6 +36,21 @@ describe('auth', function(){
         .expect(200, /Authentication failed/, done)
       })
     })
+
+    it('should display login error for bad password', function (done) {
+      request(app)
+        .post('/login')
+        .type('urlencoded')
+        .send('username=tj&password=nogood')
+        .expect('Location', '/login')
+        .expect(302, function (err, res) {
+          if (err) return done(err)
+          request(app)
+            .get('/login')
+            .set('Cookie', getCookie(res))
+            .expect(200, /Authentication failed/, done)
+        })
+    })
   })
 
   describe('GET /logout',function(){

From a84e73b958a610963e6b6ba2d16eeb81559bb7f3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 01:23:40 -0500
Subject: [PATCH 270/479] tests: add test for hello-world example

---
 examples/hello-world/index.js  |  2 +-
 test/acceptance/hello-world.js | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 test/acceptance/hello-world.js

diff --git a/examples/hello-world/index.js b/examples/hello-world/index.js
index 04382ac3d0b..d82452f331f 100644
--- a/examples/hello-world/index.js
+++ b/examples/hello-world/index.js
@@ -1,6 +1,6 @@
 var express = require('../../');
 
-var app = express();
+var app = module.exports = express()
 
 app.get('/', function(req, res){
   res.send('Hello World');
diff --git a/test/acceptance/hello-world.js b/test/acceptance/hello-world.js
new file mode 100644
index 00000000000..db90349c496
--- /dev/null
+++ b/test/acceptance/hello-world.js
@@ -0,0 +1,21 @@
+
+var app = require('../../examples/hello-world')
+var request = require('supertest')
+
+describe('hello-world', function () {
+  describe('GET /', function () {
+    it('should respond with hello world', function (done) {
+      request(app)
+        .get('/')
+        .expect(200, 'Hello World', done)
+    })
+  })
+
+  describe('GET /missing', function () {
+    it('should respond with 404', function (done) {
+      request(app)
+        .get('/missing')
+        .expect(404, done)
+    })
+  })
+})

From 8b9757e8b80d5fd1a5105f9caed8ce5f9aea6c46 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 01:25:55 -0500
Subject: [PATCH 271/479] build: fix running linter in CI

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 80248fab691..e2a4945645e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -133,6 +133,7 @@ jobs:
         echo "node@$(node -v)"
         echo "npm@$(npm -v)"
         npm -s ls ||:
+        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print "::set-output name=" $2 "::" $3 }'
 
     - name: Run tests
       shell: bash

From 20047bb6e40e76aa855632fb423905c4d0b038c3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 01:30:51 -0500
Subject: [PATCH 272/479] examples: use strict mode

---
 examples/auth/index.js                      | 2 ++
 examples/content-negotiation/db.js          | 2 ++
 examples/content-negotiation/index.js       | 2 ++
 examples/content-negotiation/users.js       | 1 +
 examples/cookie-sessions/index.js           | 2 ++
 examples/cookies/index.js                   | 2 ++
 examples/downloads/index.js                 | 2 ++
 examples/ejs/index.js                       | 2 ++
 examples/error-pages/index.js               | 2 ++
 examples/error/index.js                     | 2 ++
 examples/hello-world/index.js               | 2 ++
 examples/markdown/index.js                  | 2 ++
 examples/multi-router/controllers/api_v1.js | 2 ++
 examples/multi-router/controllers/api_v2.js | 2 ++
 examples/multi-router/index.js              | 2 ++
 examples/multipart/index.js                 | 2 ++
 examples/mvc/controllers/main/index.js      | 2 ++
 examples/mvc/controllers/pet/index.js       | 2 ++
 examples/mvc/controllers/user-pet/index.js  | 2 ++
 examples/mvc/controllers/user/index.js      | 2 ++
 examples/mvc/db.js                          | 2 ++
 examples/mvc/index.js                       | 2 ++
 examples/mvc/lib/boot.js                    | 2 ++
 examples/online/index.js                    | 1 +
 examples/params/index.js                    | 2 ++
 examples/resource/index.js                  | 2 ++
 examples/route-map/index.js                 | 2 ++
 examples/route-middleware/index.js          | 2 ++
 examples/route-separation/index.js          | 2 ++
 examples/route-separation/post.js           | 2 ++
 examples/route-separation/site.js           | 2 ++
 examples/route-separation/user.js           | 2 ++
 examples/search/index.js                    | 1 +
 examples/search/public/client.js            | 2 ++
 examples/session/index.js                   | 1 +
 examples/session/redis.js                   | 2 ++
 examples/static-files/index.js              | 2 ++
 examples/vhost/index.js                     | 2 ++
 examples/view-constructor/github-view.js    | 2 ++
 examples/view-constructor/index.js          | 2 ++
 examples/view-locals/index.js               | 2 ++
 examples/view-locals/user.js                | 2 ++
 examples/web-service/index.js               | 2 ++
 43 files changed, 82 insertions(+)

diff --git a/examples/auth/index.js b/examples/auth/index.js
index 70110891ad5..36205d0f994 100644
--- a/examples/auth/index.js
+++ b/examples/auth/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/content-negotiation/db.js b/examples/content-negotiation/db.js
index 43fb04baa18..f59b23bf18e 100644
--- a/examples/content-negotiation/db.js
+++ b/examples/content-negotiation/db.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var users = [];
 
 users.push({ name: 'Tobi' });
diff --git a/examples/content-negotiation/index.js b/examples/content-negotiation/index.js
index 348929e8522..280a4e22998 100644
--- a/examples/content-negotiation/index.js
+++ b/examples/content-negotiation/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var express = require('../../');
 var app = module.exports = express();
 var users = require('./db');
diff --git a/examples/content-negotiation/users.js b/examples/content-negotiation/users.js
index fe511072ec2..fe703e73a9a 100644
--- a/examples/content-negotiation/users.js
+++ b/examples/content-negotiation/users.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var users = require('./db');
 
diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index 1dda15de612..01c731c1c8f 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/cookies/index.js b/examples/cookies/index.js
index 93515e59612..04093591f79 100644
--- a/examples/cookies/index.js
+++ b/examples/cookies/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/downloads/index.js b/examples/downloads/index.js
index 9321f3bf951..91c52bb87ca 100644
--- a/examples/downloads/index.js
+++ b/examples/downloads/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/ejs/index.js b/examples/ejs/index.js
index 72780912938..a39d805a160 100644
--- a/examples/ejs/index.js
+++ b/examples/ejs/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 44333cb08fc..efa815c4740 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/error/index.js b/examples/error/index.js
index 07814d85201..d922de06cc4 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/hello-world/index.js b/examples/hello-world/index.js
index d82452f331f..8c1855c2eb7 100644
--- a/examples/hello-world/index.js
+++ b/examples/hello-world/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var express = require('../../');
 
 var app = module.exports = express()
diff --git a/examples/markdown/index.js b/examples/markdown/index.js
index df8c195fb4e..74ac05e77f3 100644
--- a/examples/markdown/index.js
+++ b/examples/markdown/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/multi-router/controllers/api_v1.js b/examples/multi-router/controllers/api_v1.js
index 08b7b5e6fdd..a301e3ee72d 100644
--- a/examples/multi-router/controllers/api_v1.js
+++ b/examples/multi-router/controllers/api_v1.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var express = require('../../..');
 
 var apiv1 = express.Router();
diff --git a/examples/multi-router/controllers/api_v2.js b/examples/multi-router/controllers/api_v2.js
index 4dd708281c2..e997fb1f88c 100644
--- a/examples/multi-router/controllers/api_v2.js
+++ b/examples/multi-router/controllers/api_v2.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var express = require('../../..');
 
 var apiv2 = express.Router();
diff --git a/examples/multi-router/index.js b/examples/multi-router/index.js
index 78bae9d6e36..dbfd2841262 100644
--- a/examples/multi-router/index.js
+++ b/examples/multi-router/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var express = require('../..');
 
 var app = module.exports = express();
diff --git a/examples/multipart/index.js b/examples/multipart/index.js
index 42c2af23f74..ea7b86e0c94 100644
--- a/examples/multipart/index.js
+++ b/examples/multipart/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/mvc/controllers/main/index.js b/examples/mvc/controllers/main/index.js
index 031862d345e..74cde191cd8 100644
--- a/examples/mvc/controllers/main/index.js
+++ b/examples/mvc/controllers/main/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 exports.index = function(req, res){
   res.redirect('/users');
 };
diff --git a/examples/mvc/controllers/pet/index.js b/examples/mvc/controllers/pet/index.js
index 157a98e84e2..214160f9a46 100644
--- a/examples/mvc/controllers/pet/index.js
+++ b/examples/mvc/controllers/pet/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/mvc/controllers/user-pet/index.js b/examples/mvc/controllers/user-pet/index.js
index 416b00741a2..42a29adebe7 100644
--- a/examples/mvc/controllers/user-pet/index.js
+++ b/examples/mvc/controllers/user-pet/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/mvc/controllers/user/index.js b/examples/mvc/controllers/user/index.js
index a7b0208c8e7..ec3ae4c8110 100644
--- a/examples/mvc/controllers/user/index.js
+++ b/examples/mvc/controllers/user/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/mvc/db.js b/examples/mvc/db.js
index c992afcfd74..94d1480f9b7 100644
--- a/examples/mvc/db.js
+++ b/examples/mvc/db.js
@@ -1,3 +1,5 @@
+'use strict'
+
 // faux database
 
 var pets = exports.pets = [];
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 77885a60ca0..da4727b282d 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/mvc/lib/boot.js b/examples/mvc/lib/boot.js
index 422330dc066..0216e5d76d6 100644
--- a/examples/mvc/lib/boot.js
+++ b/examples/mvc/lib/boot.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/online/index.js b/examples/online/index.js
index f14474c08d3..0b5fdffc86a 100644
--- a/examples/online/index.js
+++ b/examples/online/index.js
@@ -1,3 +1,4 @@
+'use strict'
 
 // install redis first:
 // https://redis.io/
diff --git a/examples/params/index.js b/examples/params/index.js
index 5b57573d1e8..b153b93b988 100644
--- a/examples/params/index.js
+++ b/examples/params/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/resource/index.js b/examples/resource/index.js
index b79ad923d27..ff1f6fe11f4 100644
--- a/examples/resource/index.js
+++ b/examples/resource/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/route-map/index.js b/examples/route-map/index.js
index e7adf5fcb4b..2bc28bd4b26 100644
--- a/examples/route-map/index.js
+++ b/examples/route-map/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/route-middleware/index.js b/examples/route-middleware/index.js
index e7a0901fa8f..44ec13a95b8 100644
--- a/examples/route-middleware/index.js
+++ b/examples/route-middleware/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index 65121091348..5d483811111 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/route-separation/post.js b/examples/route-separation/post.js
index e3f12e78847..3a8e3a2d225 100644
--- a/examples/route-separation/post.js
+++ b/examples/route-separation/post.js
@@ -1,3 +1,5 @@
+'use strict'
+
 // Fake posts database
 
 var posts = [
diff --git a/examples/route-separation/site.js b/examples/route-separation/site.js
index a3d20bc8a1f..aee36d1bd72 100644
--- a/examples/route-separation/site.js
+++ b/examples/route-separation/site.js
@@ -1,3 +1,5 @@
+'use strict'
+
 exports.index = function(req, res){
   res.render('index', { title: 'Route Separation Example' });
 };
diff --git a/examples/route-separation/user.js b/examples/route-separation/user.js
index ef79b343a28..1c2aec7cd23 100644
--- a/examples/route-separation/user.js
+++ b/examples/route-separation/user.js
@@ -1,3 +1,5 @@
+'use strict'
+
 // Fake user database
 
 var users = [
diff --git a/examples/search/index.js b/examples/search/index.js
index 246993caa5a..0d19444e525 100644
--- a/examples/search/index.js
+++ b/examples/search/index.js
@@ -1,3 +1,4 @@
+'use strict'
 
 // install redis first:
 // https://redis.io/
diff --git a/examples/search/public/client.js b/examples/search/public/client.js
index 75c37d8e00e..cd43faf71e0 100644
--- a/examples/search/public/client.js
+++ b/examples/search/public/client.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var search = document.querySelector('[type=search]');
 var code = document.querySelector('pre');
 
diff --git a/examples/session/index.js b/examples/session/index.js
index 9bae48b8d33..2bb2b109c82 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -1,3 +1,4 @@
+'use strict'
 
 // install redis first:
 // https://redis.io/
diff --git a/examples/session/redis.js b/examples/session/redis.js
index 1338d6e95e6..bbbdc7fd3e5 100644
--- a/examples/session/redis.js
+++ b/examples/session/redis.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/static-files/index.js b/examples/static-files/index.js
index 0e44313d15d..609c546b470 100644
--- a/examples/static-files/index.js
+++ b/examples/static-files/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/vhost/index.js b/examples/vhost/index.js
index 4a0c17b8502..a9499356b42 100644
--- a/examples/vhost/index.js
+++ b/examples/vhost/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/view-constructor/github-view.js b/examples/view-constructor/github-view.js
index 0a98a908434..43d29336cac 100644
--- a/examples/view-constructor/github-view.js
+++ b/examples/view-constructor/github-view.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/view-constructor/index.js b/examples/view-constructor/index.js
index 175a254e4ee..3d673670e31 100644
--- a/examples/view-constructor/index.js
+++ b/examples/view-constructor/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/view-locals/index.js b/examples/view-locals/index.js
index cb41509606b..bf52d2a85ad 100644
--- a/examples/view-locals/index.js
+++ b/examples/view-locals/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */
diff --git a/examples/view-locals/user.js b/examples/view-locals/user.js
index 90ab1f389df..aaa6f85ff0e 100644
--- a/examples/view-locals/user.js
+++ b/examples/view-locals/user.js
@@ -1,3 +1,5 @@
+'use strict'
+
 module.exports = User;
 
 // faux model
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 3685619d105..c22fea40323 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -1,3 +1,5 @@
+'use strict'
+
 /**
  * Module dependencies.
  */

From 215f484fb4d8b71ae079f3d8a9d43e3470dacc5c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 01:42:35 -0500
Subject: [PATCH 273/479] tests: fix wording of req.accepts* test cases

---
 test/req.acceptsEncoding.js  | 34 ++++++++++++-----------
 test/req.acceptsEncodings.js | 34 ++++++++++++-----------
 test/req.acceptsLanguage.js  | 53 +++++++++++++++++++-----------------
 test/req.acceptsLanguages.js | 53 +++++++++++++++++++-----------------
 4 files changed, 92 insertions(+), 82 deletions(-)

diff --git a/test/req.acceptsEncoding.js b/test/req.acceptsEncoding.js
index 9ed9197829f..f2af68da22a 100644
--- a/test/req.acceptsEncoding.js
+++ b/test/req.acceptsEncoding.js
@@ -4,33 +4,35 @@ var express = require('../')
 
 describe('req', function(){
   describe('.acceptsEncoding', function(){
-    it('should be true if encoding accepted', function(done){
+    it('should return encoding if accepted', function (done) {
       var app = express();
 
-      app.use(function(req, res){
-        req.acceptsEncoding('gzip').should.be.ok()
-        req.acceptsEncoding('deflate').should.be.ok()
-        res.end();
-      });
+      app.get('/', function (req, res) {
+        res.send({
+          gzip: req.acceptsEncoding('gzip'),
+          deflate: req.acceptsEncoding('deflate')
+        })
+      })
 
       request(app)
-      .get('/')
-      .set('Accept-Encoding', ' gzip, deflate')
-      .expect(200, done);
+        .get('/')
+        .set('Accept-Encoding', ' gzip, deflate')
+        .expect(200, { gzip: 'gzip', deflate: 'deflate' }, done)
     })
 
     it('should be false if encoding not accepted', function(done){
       var app = express();
 
-      app.use(function(req, res){
-        req.acceptsEncoding('bogus').should.not.be.ok()
-        res.end();
-      });
+      app.get('/', function (req, res) {
+        res.send({
+          bogus: req.acceptsEncoding('bogus')
+        })
+      })
 
       request(app)
-      .get('/')
-      .set('Accept-Encoding', ' gzip, deflate')
-      .expect(200, done);
+        .get('/')
+        .set('Accept-Encoding', ' gzip, deflate')
+        .expect(200, { bogus: false }, done)
     })
   })
 })
diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
index a5cf747d41c..dc21c4edda1 100644
--- a/test/req.acceptsEncodings.js
+++ b/test/req.acceptsEncodings.js
@@ -4,33 +4,35 @@ var express = require('../')
 
 describe('req', function(){
   describe('.acceptsEncodings', function () {
-    it('should be true if encoding accepted', function(done){
+    it('should return encoding if accepted', function (done) {
       var app = express();
 
-      app.use(function(req, res){
-        req.acceptsEncodings('gzip').should.be.ok()
-        req.acceptsEncodings('deflate').should.be.ok()
-        res.end();
-      });
+      app.get('/', function (req, res) {
+        res.send({
+          gzip: req.acceptsEncoding('gzip'),
+          deflate: req.acceptsEncoding('deflate')
+        })
+      })
 
       request(app)
-      .get('/')
-      .set('Accept-Encoding', ' gzip, deflate')
-      .expect(200, done);
+        .get('/')
+        .set('Accept-Encoding', ' gzip, deflate')
+        .expect(200, { gzip: 'gzip', deflate: 'deflate' }, done)
     })
 
     it('should be false if encoding not accepted', function(done){
       var app = express();
 
-      app.use(function(req, res){
-        req.acceptsEncodings('bogus').should.not.be.ok()
-        res.end();
-      });
+      app.get('/', function (req, res) {
+        res.send({
+          bogus: req.acceptsEncoding('bogus')
+        })
+      })
 
       request(app)
-      .get('/')
-      .set('Accept-Encoding', ' gzip, deflate')
-      .expect(200, done);
+        .get('/')
+        .set('Accept-Encoding', ' gzip, deflate')
+        .expect(200, { bogus: false }, done)
     })
   })
 })
diff --git a/test/req.acceptsLanguage.js b/test/req.acceptsLanguage.js
index 1c7c5fd86f6..616e7239460 100644
--- a/test/req.acceptsLanguage.js
+++ b/test/req.acceptsLanguage.js
@@ -4,49 +4,52 @@ var express = require('../')
 
 describe('req', function(){
   describe('.acceptsLanguage', function(){
-    it('should be true if language accepted', function(done){
+    it('should return language if accepted', function (done) {
       var app = express();
 
-      app.use(function(req, res){
-        req.acceptsLanguage('en-us').should.be.ok()
-        req.acceptsLanguage('en').should.be.ok()
-        res.end();
-      });
+      app.get('/', function (req, res) {
+        res.send({
+          'en-us': req.acceptsLanguages('en-us'),
+          en: req.acceptsLanguages('en')
+        })
+      })
 
       request(app)
-      .get('/')
-      .set('Accept-Language', 'en;q=.5, en-us')
-      .expect(200, done);
+        .get('/')
+        .set('Accept-Language', 'en;q=.5, en-us')
+        .expect(200, { 'en-us': 'en-us', en: 'en' }, done)
     })
 
     it('should be false if language not accepted', function(done){
       var app = express();
 
-      app.use(function(req, res){
-        req.acceptsLanguage('es').should.not.be.ok()
-        res.end();
-      });
+      app.get('/', function (req, res) {
+        res.send({
+          es: req.acceptsLanguages('es')
+        })
+      })
 
       request(app)
-      .get('/')
-      .set('Accept-Language', 'en;q=.5, en-us')
-      .expect(200, done);
+        .get('/')
+        .set('Accept-Language', 'en;q=.5, en-us')
+        .expect(200, { es: false }, done)
     })
 
     describe('when Accept-Language is not present', function(){
-      it('should always return true', function(done){
+      it('should always return language', function (done) {
         var app = express();
 
-        app.use(function(req, res){
-          req.acceptsLanguage('en').should.be.ok()
-          req.acceptsLanguage('es').should.be.ok()
-          req.acceptsLanguage('jp').should.be.ok()
-          res.end();
-        });
+        app.get('/', function (req, res) {
+          res.send({
+            en: req.acceptsLanguages('en'),
+            es: req.acceptsLanguages('es'),
+            jp: req.acceptsLanguages('jp')
+          })
+        })
 
         request(app)
-        .get('/')
-        .expect(200, done);
+          .get('/')
+          .expect(200, { en: 'en', es: 'es', jp: 'jp' }, done)
       })
     })
   })
diff --git a/test/req.acceptsLanguages.js b/test/req.acceptsLanguages.js
index 1d92f44b2b3..87bf7b25df1 100644
--- a/test/req.acceptsLanguages.js
+++ b/test/req.acceptsLanguages.js
@@ -4,49 +4,52 @@ var express = require('../')
 
 describe('req', function(){
   describe('.acceptsLanguages', function(){
-    it('should be true if language accepted', function(done){
+    it('should return language if accepted', function (done) {
       var app = express();
 
-      app.use(function(req, res){
-        req.acceptsLanguages('en-us').should.be.ok()
-        req.acceptsLanguages('en').should.be.ok()
-        res.end();
-      });
+      app.get('/', function (req, res) {
+        res.send({
+          'en-us': req.acceptsLanguages('en-us'),
+          en: req.acceptsLanguages('en')
+        })
+      })
 
       request(app)
-      .get('/')
-      .set('Accept-Language', 'en;q=.5, en-us')
-      .expect(200, done);
+        .get('/')
+        .set('Accept-Language', 'en;q=.5, en-us')
+        .expect(200, { 'en-us': 'en-us', en: 'en' }, done)
     })
 
     it('should be false if language not accepted', function(done){
       var app = express();
 
-      app.use(function(req, res){
-        req.acceptsLanguages('es').should.not.be.ok()
-        res.end();
-      });
+      app.get('/', function (req, res) {
+        res.send({
+          es: req.acceptsLanguages('es')
+        })
+      })
 
       request(app)
-      .get('/')
-      .set('Accept-Language', 'en;q=.5, en-us')
-      .expect(200, done);
+        .get('/')
+        .set('Accept-Language', 'en;q=.5, en-us')
+        .expect(200, { es: false }, done)
     })
 
     describe('when Accept-Language is not present', function(){
-      it('should always return true', function(done){
+      it('should always return language', function (done) {
         var app = express();
 
-        app.use(function(req, res){
-          req.acceptsLanguages('en').should.be.ok()
-          req.acceptsLanguages('es').should.be.ok()
-          req.acceptsLanguages('jp').should.be.ok()
-          res.end();
-        });
+        app.get('/', function (req, res) {
+          res.send({
+            en: req.acceptsLanguages('en'),
+            es: req.acceptsLanguages('es'),
+            jp: req.acceptsLanguages('jp')
+          })
+        })
 
         request(app)
-        .get('/')
-        .expect(200, done);
+          .get('/')
+          .expect(200, { en: 'en', es: 'es', jp: 'jp' }, done)
       })
     })
   })

From bd4fdfe5f771d07ef544c4a91bd6bfc4cc711f9b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 01:55:16 -0500
Subject: [PATCH 274/479] tests: remove global dependency on should

fixes #4797
---
 test/app.engine.js       | 13 ++++----
 test/app.js              | 24 +++++++--------
 test/app.locals.js       | 14 +++++----
 test/app.param.js        | 30 +++++++++----------
 test/app.render.js       | 54 ++++++++++++++++-----------------
 test/app.router.js       |  4 +--
 test/app.routes.error.js | 14 +++++----
 test/app.use.js          |  8 ++---
 test/req.query.js        |  4 ++-
 test/req.route.js        | 10 ++++---
 test/req.xhr.js          | 65 ++++++++++++++--------------------------
 test/res.cookie.js       | 28 ++++++-----------
 test/res.send.js         |  2 +-
 test/utils.js            | 37 ++++++++++++-----------
 14 files changed, 142 insertions(+), 165 deletions(-)

diff --git a/test/app.engine.js b/test/app.engine.js
index b198292fa03..0d54c90d563 100644
--- a/test/app.engine.js
+++ b/test/app.engine.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('../')
   , fs = require('fs');
 var path = require('path')
@@ -22,16 +23,16 @@ describe('app', function(){
 
       app.render('user.html', function(err, str){
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
 
     it('should throw when the callback is missing', function(){
       var app = express();
-      (function(){
+      assert.throws(function () {
         app.engine('.html', null);
-      }).should.throw('callback function required');
+      }, /callback function required/)
     })
 
     it('should work without leading "."', function(done){
@@ -43,7 +44,7 @@ describe('app', function(){
 
       app.render('user.html', function(err, str){
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
@@ -58,7 +59,7 @@ describe('app', function(){
 
       app.render('user', function(err, str){
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
@@ -73,7 +74,7 @@ describe('app', function(){
 
       app.render('user', function(err, str){
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
diff --git a/test/app.js b/test/app.js
index e52365c36bb..d0756795d3c 100644
--- a/test/app.js
+++ b/test/app.js
@@ -32,8 +32,8 @@ describe('app.parent', function(){
     blog.use('/admin', blogAdmin);
 
     assert(!app.parent, 'app.parent');
-    blog.parent.should.equal(app);
-    blogAdmin.parent.should.equal(blog);
+    assert.strictEqual(blog.parent, app)
+    assert.strictEqual(blogAdmin.parent, blog)
   })
 })
 
@@ -48,10 +48,10 @@ describe('app.mountpath', function(){
     app.use(fallback);
     blog.use('/admin', admin);
 
-    admin.mountpath.should.equal('/admin');
-    app.mountpath.should.equal('/');
-    blog.mountpath.should.equal('/blog');
-    fallback.mountpath.should.equal('/');
+    assert.strictEqual(admin.mountpath, '/admin')
+    assert.strictEqual(app.mountpath, '/')
+    assert.strictEqual(blog.mountpath, '/blog')
+    assert.strictEqual(fallback.mountpath, '/')
   })
 })
 
@@ -76,9 +76,9 @@ describe('app.path()', function(){
     app.use('/blog', blog);
     blog.use('/admin', blogAdmin);
 
-    app.path().should.equal('');
-    blog.path().should.equal('/blog');
-    blogAdmin.path().should.equal('/blog/admin');
+    assert.strictEqual(app.path(), '')
+    assert.strictEqual(blog.path(), '/blog')
+    assert.strictEqual(blogAdmin.path(), '/blog/admin')
   })
 })
 
@@ -86,7 +86,7 @@ describe('in development', function(){
   it('should disable "view cache"', function(){
     process.env.NODE_ENV = 'development';
     var app = express();
-    app.enabled('view cache').should.be.false()
+    assert.ok(!app.enabled('view cache'))
     process.env.NODE_ENV = 'test';
   })
 })
@@ -95,7 +95,7 @@ describe('in production', function(){
   it('should enable "view cache"', function(){
     process.env.NODE_ENV = 'production';
     var app = express();
-    app.enabled('view cache').should.be.true()
+    assert.ok(app.enabled('view cache'))
     process.env.NODE_ENV = 'test';
   })
 })
@@ -104,7 +104,7 @@ describe('without NODE_ENV', function(){
   it('should default to development', function(){
     process.env.NODE_ENV = '';
     var app = express();
-    app.get('env').should.equal('development');
+    assert.strictEqual(app.get('env'), 'development')
     process.env.NODE_ENV = 'test';
   })
 })
diff --git a/test/app.locals.js b/test/app.locals.js
index d8bfb5a9874..0b14ac90704 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -1,16 +1,18 @@
 
+var assert = require('assert')
 var express = require('../')
+var should = require('should')
 
 describe('app', function(){
   describe('.locals(obj)', function(){
     it('should merge locals', function(){
       var app = express();
-      Object.keys(app.locals).should.eql(['settings']);
+      should(Object.keys(app.locals)).eql(['settings'])
       app.locals.user = 'tobi';
       app.locals.age = 2;
-      Object.keys(app.locals).should.eql(['settings', 'user', 'age']);
-      app.locals.user.should.equal('tobi');
-      app.locals.age.should.equal(2);
+      should(Object.keys(app.locals)).eql(['settings', 'user', 'age'])
+      assert.strictEqual(app.locals.user, 'tobi')
+      assert.strictEqual(app.locals.age, 2)
     })
   })
 
@@ -19,8 +21,8 @@ describe('app', function(){
       var app = express();
       app.set('title', 'House of Manny');
       var obj = app.locals.settings;
-      obj.should.have.property('env', 'test');
-      obj.should.have.property('title', 'House of Manny');
+      should(obj).have.property('env', 'test')
+      should(obj).have.property('title', 'House of Manny')
     })
   })
 })
diff --git a/test/app.param.js b/test/app.param.js
index 577b00710b3..7dbe3ffb610 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('../')
   , request = require('supertest');
 
@@ -40,7 +41,7 @@ describe('app', function(){
 
     it('should fail if not given fn', function(){
       var app = express();
-      app.param.bind(app, ':name', 'bob').should.throw();
+      assert.throws(app.param.bind(app, ':name', 'bob'))
     })
   })
 
@@ -57,24 +58,22 @@ describe('app', function(){
 
       app.get('/post/:id', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number()
-        res.send('' + id);
+        res.send((typeof id) + ':' + id)
       });
 
       app.get('/user/:uid', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number()
-        res.send('' + id);
+        res.send((typeof id) + ':' + id)
       });
 
       request(app)
-      .get('/user/123')
-      .expect(200, '123', function (err) {
-        if (err) return done(err)
-        request(app)
-        .get('/post/123')
-        .expect('123', done);
-      })
+        .get('/user/123')
+        .expect(200, 'number:123', function (err) {
+          if (err) return done(err)
+          request(app)
+            .get('/post/123')
+            .expect('number:123', done)
+        })
     })
   })
 
@@ -91,13 +90,12 @@ describe('app', function(){
 
       app.get('/user/:id', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number()
-        res.send('' + id);
+        res.send((typeof id) + ':' + id)
       });
 
       request(app)
-      .get('/user/123')
-      .expect('123', done);
+        .get('/user/123')
+        .expect(200, 'number:123', done)
     })
 
     it('should only call once per request', function(done) {
diff --git a/test/app.render.js b/test/app.render.js
index 54f6c2ca82d..d0b367189b0 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -13,7 +13,7 @@ describe('app', function(){
 
       app.render(path.join(__dirname, 'fixtures', 'user.tmpl'), function (err, str) {
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
@@ -26,7 +26,7 @@ describe('app', function(){
 
       app.render(path.join(__dirname, 'fixtures', 'user'), function (err, str) {
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
@@ -39,7 +39,7 @@ describe('app', function(){
 
       app.render('user.tmpl', function (err, str) {
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
@@ -52,7 +52,7 @@ describe('app', function(){
 
       app.render('blog/post', function (err, str) {
         if (err) return done(err);
-        str.should.equal('<h1>blog post</h1>');
+        assert.strictEqual(str, '<h1>blog post</h1>')
         done();
       })
     })
@@ -72,8 +72,8 @@ describe('app', function(){
       app.set('view', View);
 
       app.render('something', function(err, str){
-        err.should.be.ok()
-        err.message.should.equal('err!');
+        assert.ok(err)
+        assert.strictEqual(err.message, 'err!')
         done();
       })
     })
@@ -113,7 +113,7 @@ describe('app', function(){
 
         app.render('email.tmpl', function (err, str) {
           if (err) return done(err);
-          str.should.equal('<p>This is an email</p>');
+          assert.strictEqual(str, '<p>This is an email</p>')
           done();
         })
       })
@@ -128,7 +128,7 @@ describe('app', function(){
 
         app.render('email', function(err, str){
           if (err) return done(err);
-          str.should.equal('<p>This is an email</p>');
+          assert.strictEqual(str, '<p>This is an email</p>')
           done();
         })
       })
@@ -143,7 +143,7 @@ describe('app', function(){
 
         app.render('user.tmpl', function (err, str) {
           if (err) return done(err);
-          str.should.equal('<p>tobi</p>');
+          assert.strictEqual(str, '<p>tobi</p>')
           done();
         })
       })
@@ -161,7 +161,7 @@ describe('app', function(){
 
           app.render('user.tmpl', function (err, str) {
             if (err) return done(err);
-            str.should.equal('<span>tobi</span>');
+            assert.strictEqual(str, '<span>tobi</span>')
             done();
           })
         })
@@ -178,7 +178,7 @@ describe('app', function(){
 
           app.render('name.tmpl', function (err, str) {
             if (err) return done(err);
-            str.should.equal('<p>tobi</p>');
+            assert.strictEqual(str, '<p>tobi</p>')
             done();
           })
         })
@@ -219,7 +219,7 @@ describe('app', function(){
 
         app.render('something', function(err, str){
           if (err) return done(err);
-          str.should.equal('abstract engine');
+          assert.strictEqual(str, 'abstract engine')
           done();
         })
       })
@@ -245,12 +245,12 @@ describe('app', function(){
 
         app.render('something', function(err, str){
           if (err) return done(err);
-          count.should.equal(1);
-          str.should.equal('abstract engine');
+          assert.strictEqual(count, 1)
+          assert.strictEqual(str, 'abstract engine')
           app.render('something', function(err, str){
             if (err) return done(err);
-            count.should.equal(2);
-            str.should.equal('abstract engine');
+            assert.strictEqual(count, 2)
+            assert.strictEqual(str, 'abstract engine')
             done();
           })
         })
@@ -275,12 +275,12 @@ describe('app', function(){
 
         app.render('something', function(err, str){
           if (err) return done(err);
-          count.should.equal(1);
-          str.should.equal('abstract engine');
+          assert.strictEqual(count, 1)
+          assert.strictEqual(str, 'abstract engine')
           app.render('something', function(err, str){
             if (err) return done(err);
-            count.should.equal(1);
-            str.should.equal('abstract engine');
+            assert.strictEqual(count, 1)
+            assert.strictEqual(str, 'abstract engine')
             done();
           })
         })
@@ -298,7 +298,7 @@ describe('app', function(){
 
       app.render('user.tmpl', { user: user }, function (err, str) {
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
@@ -311,7 +311,7 @@ describe('app', function(){
 
       app.render('user.tmpl', {}, function (err, str) {
         if (err) return done(err);
-        str.should.equal('<p>tobi</p>');
+        assert.strictEqual(str, '<p>tobi</p>')
         done();
       })
     })
@@ -325,7 +325,7 @@ describe('app', function(){
 
       app.render('user.tmpl', { user: jane }, function (err, str) {
         if (err) return done(err);
-        str.should.equal('<p>jane</p>');
+        assert.strictEqual(str, '<p>jane</p>')
         done();
       })
     })
@@ -350,12 +350,12 @@ describe('app', function(){
 
         app.render('something', {cache: true}, function(err, str){
           if (err) return done(err);
-          count.should.equal(1);
-          str.should.equal('abstract engine');
+          assert.strictEqual(count, 1)
+          assert.strictEqual(str, 'abstract engine')
           app.render('something', {cache: true}, function(err, str){
             if (err) return done(err);
-            count.should.equal(1);
-            str.should.equal('abstract engine');
+            assert.strictEqual(count, 1)
+            assert.strictEqual(str, 'abstract engine')
             done();
           })
         })
diff --git a/test/app.router.js b/test/app.router.js
index a4fe57cc2bb..6edb93d6ea3 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -51,7 +51,7 @@ describe('app.router', function(){
 
       it('should reject numbers for app.' + method, function(){
         var app = express();
-        app[method].bind(app, '/', 3).should.throw(/Number/);
+        assert.throws(app[method].bind(app, '/', 3), /Number/)
       })
     });
 
@@ -1102,6 +1102,6 @@ describe('app.router', function(){
 
   it('should be chainable', function(){
     var app = express();
-    app.get('/', function(){}).should.equal(app);
+    assert.strictEqual(app.get('/', function () {}), app)
   })
 })
diff --git a/test/app.routes.error.js b/test/app.routes.error.js
index cbbc23ef574..b1f95d0d6e0 100644
--- a/test/app.routes.error.js
+++ b/test/app.routes.error.js
@@ -1,3 +1,5 @@
+
+var assert = require('assert')
 var express = require('../')
   , request = require('supertest');
 
@@ -34,20 +36,20 @@ describe('app', function(){
         next();
       }, function(err, req, res, next){
         b = true;
-        err.message.should.equal('fabricated error');
+        assert.strictEqual(err.message, 'fabricated error')
         next(err);
       }, function(err, req, res, next){
         c = true;
-        err.message.should.equal('fabricated error');
+        assert.strictEqual(err.message, 'fabricated error')
         next();
       }, function(err, req, res, next){
         d = true;
         next();
       }, function(req, res){
-        a.should.be.false()
-        b.should.be.true()
-        c.should.be.true()
-        d.should.be.false()
+        assert.ok(!a)
+        assert.ok(b)
+        assert.ok(c)
+        assert.ok(!d)
         res.send(204);
       });
 
diff --git a/test/app.use.js b/test/app.use.js
index 347937fbb3b..7987405a8b3 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -10,7 +10,7 @@ describe('app', function(){
       , app = express();
 
     blog.on('mount', function(arg){
-      arg.should.equal(app);
+      assert.strictEqual(arg, app)
       done();
     });
 
@@ -63,7 +63,7 @@ describe('app', function(){
         , app = express();
 
       app.use('/blog', blog);
-      blog.parent.should.equal(app);
+      assert.strictEqual(blog.parent, app)
     })
 
     it('should support dynamic routes', function(done){
@@ -102,11 +102,11 @@ describe('app', function(){
       });
 
       blog.once('mount', function (parent) {
-        parent.should.equal(app);
+        assert.strictEqual(parent, app)
         cb();
       });
       other.once('mount', function (parent) {
-        parent.should.equal(app);
+        assert.strictEqual(parent, app)
         cb();
       });
 
diff --git a/test/req.query.js b/test/req.query.js
index 0e810b8ef91..f3e8df8a188 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('../')
   , request = require('supertest');
 
@@ -99,7 +100,8 @@ describe('req', function(){
 
     describe('when "query parser" an unknown value', function () {
       it('should throw', function () {
-        createApp.bind(null, 'bogus').should.throw(/unknown value.*query parser/);
+        assert.throws(createApp.bind(null, 'bogus'),
+          /unknown value.*query parser/)
       });
     });
   })
diff --git a/test/req.route.js b/test/req.route.js
index 2947b7c3d0f..b32d470bd6a 100644
--- a/test/req.route.js
+++ b/test/req.route.js
@@ -8,18 +8,20 @@ describe('req', function(){
       var app = express();
 
       app.get('/user/:id/:op?', function(req, res, next){
-        req.route.path.should.equal('/user/:id/:op?');
+        res.header('path-1', req.route.path)
         next();
       });
 
       app.get('/user/:id/edit', function(req, res){
-        req.route.path.should.equal('/user/:id/edit');
+        res.header('path-2', req.route.path)
         res.end();
       });
 
       request(app)
-      .get('/user/12/edit')
-      .expect(200, done);
+        .get('/user/12/edit')
+        .expect('path-1', '/user/:id/:op?')
+        .expect('path-2', '/user/:id/edit')
+        .expect(200, done)
     })
   })
 })
diff --git a/test/req.xhr.js b/test/req.xhr.js
index 94af9170cb3..3ad1c6fb726 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -4,59 +4,38 @@ var express = require('../')
 
 describe('req', function(){
   describe('.xhr', function(){
-    it('should return true when X-Requested-With is xmlhttprequest', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.xhr.should.be.true()
-        res.end();
-      });
+    before(function () {
+      this.app = express()
+      this.app.get('/', function (req, res) {
+        res.send(req.xhr)
+      })
+    })
 
-      request(app)
-      .get('/')
-      .set('X-Requested-With', 'xmlhttprequest')
-      .expect(200, done)
+    it('should return true when X-Requested-With is xmlhttprequest', function(done){
+      request(this.app)
+        .get('/')
+        .set('X-Requested-With', 'xmlhttprequest')
+        .expect(200, 'true', done)
     })
 
     it('should case-insensitive', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.xhr.should.be.true()
-        res.end();
-      });
-
-      request(app)
-      .get('/')
-      .set('X-Requested-With', 'XMLHttpRequest')
-      .expect(200, done)
+      request(this.app)
+        .get('/')
+        .set('X-Requested-With', 'XMLHttpRequest')
+        .expect(200, 'true', done)
     })
 
     it('should return false otherwise', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.xhr.should.be.false()
-        res.end();
-      });
-
-      request(app)
-      .get('/')
-      .set('X-Requested-With', 'blahblah')
-      .expect(200, done)
+      request(this.app)
+        .get('/')
+        .set('X-Requested-With', 'blahblah')
+        .expect(200, 'false', done)
     })
 
     it('should return false when not present', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.xhr.should.be.false()
-        res.end();
-      });
-
-      request(app)
-      .get('/')
-      .expect(200, done)
+      request(this.app)
+        .get('/')
+        .expect(200, 'false', done)
     })
   })
 })
diff --git a/test/res.cookie.js b/test/res.cookie.js
index d8e6b7ca859..8f8662c217a 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , cookie = require('cookie')
   , cookieParser = require('cookie-parser')
 var merge = require('utils-merge');
 
@@ -46,12 +45,9 @@ describe('res', function(){
       });
 
       request(app)
-      .get('/')
-      .end(function(err, res){
-        var val = ['name=tobi; Path=/', 'age=1; Path=/', 'gender=%3F; Path=/'];
-        res.headers['set-cookie'].should.eql(val);
-        done();
-      })
+        .get('/')
+        .expect('Set-Cookie', 'name=tobi; Path=/,age=1; Path=/,gender=%3F; Path=/')
+        .expect(200, done)
     })
   })
 
@@ -80,11 +76,9 @@ describe('res', function(){
         });
 
         request(app)
-        .get('/')
-        .end(function(err, res){
-          res.headers['set-cookie'][0].should.not.containEql('Thu, 01 Jan 1970 00:00:01 GMT');
-          done();
-        })
+          .get('/')
+          .expect('Set-Cookie', /name=tobi; Max-Age=1; Path=\/; Expires=/)
+          .expect(200, done)
       })
 
       it('should set max-age', function(done){
@@ -141,13 +135,9 @@ describe('res', function(){
         });
 
         request(app)
-        .get('/')
-        .end(function(err, res){
-          var val = res.headers['set-cookie'][0];
-          val = cookie.parse(val.split('.')[0]);
-          val.user.should.equal('s:j:{"name":"tobi"}');
-          done();
-        })
+          .get('/')
+          .expect('Set-Cookie', 'user=s%3Aj%3A%7B%22name%22%3A%22tobi%22%7D.K20xcwmDS%2BPb1rsD95o5Jm5SqWs1KteqdnynnB7jkTE; Path=/')
+          .expect(200, done)
       })
     })
 
diff --git a/test/res.send.js b/test/res.send.js
index b836b5e4dcb..e62caf95dc1 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -544,7 +544,7 @@ describe('res', function(){
           var chunk = !Buffer.isBuffer(body)
             ? Buffer.from(body, encoding)
             : body;
-          chunk.toString().should.equal('hello, world!');
+          assert.strictEqual(chunk.toString(), 'hello, world!')
           return '"custom"';
         });
 
diff --git a/test/utils.js b/test/utils.js
index b51d223af97..a0fac7a722c 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -1,27 +1,28 @@
 
 var assert = require('assert');
 var Buffer = require('safe-buffer').Buffer
+var should = require('should')
 var utils = require('../lib/utils');
 
 describe('utils.etag(body, encoding)', function(){
   it('should support strings', function(){
-    utils.etag('express!')
-    .should.eql('"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
+    assert.strictEqual(utils.etag('express!'),
+      '"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
   it('should support utf8 strings', function(){
-    utils.etag('express❤', 'utf8')
-    .should.eql('"a-JBiXf7GyzxwcrxY4hVXUwa7tmks"')
+    assert.strictEqual(utils.etag('express❤', 'utf8'),
+      '"a-JBiXf7GyzxwcrxY4hVXUwa7tmks"')
   })
 
   it('should support buffer', function(){
-    utils.etag(Buffer.from('express!'))
-    .should.eql('"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
+    assert.strictEqual(utils.etag(Buffer.from('express!')),
+      '"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
   it('should support empty string', function(){
-    utils.etag('')
-    .should.eql('"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"')
+    assert.strictEqual(utils.etag(''),
+      '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"')
   })
 })
 
@@ -49,23 +50,23 @@ describe('utils.setCharset(type, charset)', function () {
 
 describe('utils.wetag(body, encoding)', function(){
   it('should support strings', function(){
-    utils.wetag('express!')
-    .should.eql('W/"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
+    assert.strictEqual(utils.wetag('express!'),
+      'W/"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
   it('should support utf8 strings', function(){
-    utils.wetag('express❤', 'utf8')
-    .should.eql('W/"a-JBiXf7GyzxwcrxY4hVXUwa7tmks"')
+    assert.strictEqual(utils.wetag('express❤', 'utf8'),
+      'W/"a-JBiXf7GyzxwcrxY4hVXUwa7tmks"')
   })
 
   it('should support buffer', function(){
-    utils.wetag(Buffer.from('express!'))
-    .should.eql('W/"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
+    assert.strictEqual(utils.wetag(Buffer.from('express!')),
+      'W/"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
   it('should support empty string', function(){
-    utils.wetag('')
-    .should.eql('W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"')
+    assert.strictEqual(utils.wetag(''),
+      'W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"')
   })
 })
 
@@ -89,7 +90,7 @@ describe('utils.isAbsolute()', function(){
 describe('utils.flatten(arr)', function(){
   it('should flatten an array', function(){
     var arr = ['one', ['two', ['three', 'four'], 'five']];
-    utils.flatten(arr)
-      .should.eql(['one', 'two', 'three', 'four', 'five']);
+    should(utils.flatten(arr))
+      .eql(['one', 'two', 'three', 'four', 'five'])
   })
 })

From 141914e8172f5d1a08825fc60a54d944121b1ec0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 14:16:20 -0500
Subject: [PATCH 275/479] tests: fix tests that did not bubble errors

---
 test/app.all.js    | 12 +++++++-----
 test/app.head.js   | 15 ++++++---------
 test/app.router.js | 33 ++++++++++++++++++---------------
 test/app.use.js    | 11 ++++++-----
 4 files changed, 37 insertions(+), 34 deletions(-)

diff --git a/test/app.all.js b/test/app.all.js
index e9ef08831df..45c3ddb93bd 100644
--- a/test/app.all.js
+++ b/test/app.all.js
@@ -1,22 +1,24 @@
 
+var after = require('after')
 var express = require('../')
   , request = require('supertest');
 
 describe('app.all()', function(){
   it('should add a router per method', function(done){
     var app = express();
+    var cb = after(2, done)
 
     app.all('/tobi', function(req, res){
       res.end(req.method);
     });
 
     request(app)
-    .put('/tobi')
-    .expect('PUT', function(){
-      request(app)
+      .put('/tobi')
+      .expect(200, 'PUT', cb)
+
+    request(app)
       .get('/tobi')
-      .expect('GET', done);
-    });
+      .expect(200, 'GET', cb)
   })
 
   it('should run the callback for a method just once', function(done){
diff --git a/test/app.head.js b/test/app.head.js
index b417ca0c921..6aa1bb8003f 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -46,23 +46,20 @@ describe('HEAD', function(){
 describe('app.head()', function(){
   it('should override', function(done){
     var app = express()
-      , called;
 
     app.head('/tobi', function(req, res){
-      called = true;
-      res.end('');
+      res.header('x-method', 'head')
+      res.end()
     });
 
     app.get('/tobi', function(req, res){
-      assert(0, 'should not call GET');
+      res.header('x-method', 'get')
       res.send('tobi');
     });
 
     request(app)
-    .head('/tobi')
-    .expect(200, function(){
-      assert(called);
-      done();
-    });
+      .head('/tobi')
+      .expect('x-method', 'head')
+      .expect(200, done)
   })
 })
diff --git a/test/app.router.js b/test/app.router.js
index 6edb93d6ea3..8c98aa869b2 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -636,18 +636,19 @@ describe('app.router', function(){
 
     it('should work cross-segment', function(done){
       var app = express();
+      var cb = after(2, done)
 
       app.get('/api*', function(req, res){
         res.send(req.params[0]);
       });
 
       request(app)
-      .get('/api')
-      .expect('', function(){
-        request(app)
+        .get('/api')
+        .expect(200, '', cb)
+
+      request(app)
         .get('/api/hey')
-        .expect('/hey', done);
-      });
+        .expect(200, '/hey', cb)
     })
 
     it('should allow naming', function(done){
@@ -863,36 +864,38 @@ describe('app.router', function(){
   describe('.:name', function(){
     it('should denote a format', function(done){
       var app = express();
+      var cb = after(2, done)
 
       app.get('/:name.:format', function(req, res){
         res.end(req.params.name + ' as ' + req.params.format);
       });
 
       request(app)
-      .get('/foo.json')
-      .expect('foo as json', function(){
-        request(app)
+        .get('/foo.json')
+        .expect(200, 'foo as json', cb)
+
+      request(app)
         .get('/foo')
-        .expect(404, done);
-      });
+        .expect(404, cb)
     })
   })
 
   describe('.:name?', function(){
     it('should denote an optional format', function(done){
       var app = express();
+      var cb = after(2, done)
 
       app.get('/:name.:format?', function(req, res){
         res.end(req.params.name + ' as ' + (req.params.format || 'html'));
       });
 
       request(app)
-      .get('/foo')
-      .expect('foo as html', function(){
-        request(app)
+        .get('/foo')
+        .expect(200, 'foo as html', cb)
+
+      request(app)
         .get('/foo.json')
-        .expect('foo as json', done);
-      });
+        .expect(200, 'foo as json', done)
     })
   })
 
diff --git a/test/app.use.js b/test/app.use.js
index 7987405a8b3..55ba0689c8d 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -37,6 +37,7 @@ describe('app', function(){
       var blog = express()
         , forum = express()
         , app = express();
+      var cb = after(2, done)
 
       blog.get('/', function(req, res){
         res.end('blog');
@@ -50,12 +51,12 @@ describe('app', function(){
       app.use('/forum', forum);
 
       request(app)
-      .get('/blog')
-      .expect('blog', function(){
-        request(app)
+        .get('/blog')
+        .expect(200, 'blog', cb)
+
+      request(app)
         .get('/forum')
-        .expect('forum', done);
-      });
+        .expect(200, 'forum', done)
     })
 
     it('should set the child\'s .parent', function(){

From 00ad5bee96bade1b776be62c7f1912eefc41793d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 15:02:46 -0500
Subject: [PATCH 276/479] tests: add more tests for app.request & app.response

---
 test/app.request.js  | 119 ++++++++++++++++++++++++++++++++++++++++
 test/app.response.js | 128 ++++++++++++++++++++++++++++++++++++++-----
 2 files changed, 232 insertions(+), 15 deletions(-)

diff --git a/test/app.request.js b/test/app.request.js
index 728043a5a34..0288f80b097 100644
--- a/test/app.request.js
+++ b/test/app.request.js
@@ -1,4 +1,5 @@
 
+var after = require('after')
 var express = require('../')
   , request = require('supertest');
 
@@ -19,5 +20,123 @@ describe('app', function(){
       .get('/foo?name=tobi')
       .expect('name=tobi', done);
     })
+
+    it('should only extend for the referenced app', function (done) {
+      var app1 = express()
+      var app2 = express()
+      var cb = after(2, done)
+
+      app1.request.foobar = function () {
+        return 'tobi'
+      }
+
+      app1.get('/', function (req, res) {
+        res.send(req.foobar())
+      })
+
+      app2.get('/', function (req, res) {
+        res.send(req.foobar())
+      })
+
+      request(app1)
+        .get('/')
+        .expect(200, 'tobi', cb)
+
+      request(app2)
+        .get('/')
+        .expect(500, /(?:not a function|has no method)/, cb)
+    })
+
+    it('should inherit to sub apps', function (done) {
+      var app1 = express()
+      var app2 = express()
+      var cb = after(2, done)
+
+      app1.request.foobar = function () {
+        return 'tobi'
+      }
+
+      app1.use('/sub', app2)
+
+      app1.get('/', function (req, res) {
+        res.send(req.foobar())
+      })
+
+      app2.get('/', function (req, res) {
+        res.send(req.foobar())
+      })
+
+      request(app1)
+        .get('/')
+        .expect(200, 'tobi', cb)
+
+      request(app1)
+        .get('/sub')
+        .expect(200, 'tobi', cb)
+    })
+
+    it('should allow sub app to override', function (done) {
+      var app1 = express()
+      var app2 = express()
+      var cb = after(2, done)
+
+      app1.request.foobar = function () {
+        return 'tobi'
+      }
+
+      app2.request.foobar = function () {
+        return 'loki'
+      }
+
+      app1.use('/sub', app2)
+
+      app1.get('/', function (req, res) {
+        res.send(req.foobar())
+      })
+
+      app2.get('/', function (req, res) {
+        res.send(req.foobar())
+      })
+
+      request(app1)
+        .get('/')
+        .expect(200, 'tobi', cb)
+
+      request(app1)
+        .get('/sub')
+        .expect(200, 'loki', cb)
+    })
+
+    it('should not pollute parent app', function (done) {
+      var app1 = express()
+      var app2 = express()
+      var cb = after(2, done)
+
+      app1.request.foobar = function () {
+        return 'tobi'
+      }
+
+      app2.request.foobar = function () {
+        return 'loki'
+      }
+
+      app1.use('/sub', app2)
+
+      app1.get('/sub/foo', function (req, res) {
+        res.send(req.foobar())
+      })
+
+      app2.get('/', function (req, res) {
+        res.send(req.foobar())
+      })
+
+      request(app1)
+        .get('/sub')
+        .expect(200, 'loki', cb)
+
+      request(app1)
+        .get('/sub/foo')
+        .expect(200, 'tobi', cb)
+    })
   })
 })
diff --git a/test/app.response.js b/test/app.response.js
index c6ea77c820a..ea696b566f1 100644
--- a/test/app.response.js
+++ b/test/app.response.js
@@ -1,4 +1,5 @@
 
+var after = require('after')
 var express = require('../')
   , request = require('supertest');
 
@@ -20,25 +21,122 @@ describe('app', function(){
       .expect('HEY', done);
     })
 
-    it('should not be influenced by other app protos', function(done){
-      var app = express()
-        , app2 = express();
+    it('should only extend for the referenced app', function (done) {
+      var app1 = express()
+      var app2 = express()
+      var cb = after(2, done)
 
-      app.response.shout = function(str){
-        this.send(str.toUpperCase());
-      };
+      app1.response.shout = function (str) {
+        this.send(str.toUpperCase())
+      }
 
-      app2.response.shout = function(str){
-        this.send(str);
-      };
+      app1.get('/', function (req, res) {
+        res.shout('foo')
+      })
 
-      app.use(function(req, res){
-        res.shout('hey');
-      });
+      app2.get('/', function (req, res) {
+        res.shout('foo')
+      })
 
-      request(app)
-      .get('/')
-      .expect('HEY', done);
+      request(app1)
+        .get('/')
+        .expect(200, 'FOO', cb)
+
+      request(app2)
+        .get('/')
+        .expect(500, /(?:not a function|has no method)/, cb)
+    })
+
+    it('should inherit to sub apps', function (done) {
+      var app1 = express()
+      var app2 = express()
+      var cb = after(2, done)
+
+      app1.response.shout = function (str) {
+        this.send(str.toUpperCase())
+      }
+
+      app1.use('/sub', app2)
+
+      app1.get('/', function (req, res) {
+        res.shout('foo')
+      })
+
+      app2.get('/', function (req, res) {
+        res.shout('foo')
+      })
+
+      request(app1)
+        .get('/')
+        .expect(200, 'FOO', cb)
+
+      request(app1)
+        .get('/sub')
+        .expect(200, 'FOO', cb)
+    })
+
+    it('should allow sub app to override', function (done) {
+      var app1 = express()
+      var app2 = express()
+      var cb = after(2, done)
+
+      app1.response.shout = function (str) {
+        this.send(str.toUpperCase())
+      }
+
+      app2.response.shout = function (str) {
+        this.send(str + '!')
+      }
+
+      app1.use('/sub', app2)
+
+      app1.get('/', function (req, res) {
+        res.shout('foo')
+      })
+
+      app2.get('/', function (req, res) {
+        res.shout('foo')
+      })
+
+      request(app1)
+        .get('/')
+        .expect(200, 'FOO', cb)
+
+      request(app1)
+        .get('/sub')
+        .expect(200, 'foo!', cb)
+    })
+
+    it('should not pollute parent app', function (done) {
+      var app1 = express()
+      var app2 = express()
+      var cb = after(2, done)
+
+      app1.response.shout = function (str) {
+        this.send(str.toUpperCase())
+      }
+
+      app2.response.shout = function (str) {
+        this.send(str + '!')
+      }
+
+      app1.use('/sub', app2)
+
+      app1.get('/sub/foo', function (req, res) {
+        res.shout('foo')
+      })
+
+      app2.get('/', function (req, res) {
+        res.shout('foo')
+      })
+
+      request(app1)
+        .get('/sub')
+        .expect(200, 'foo!', cb)
+
+      request(app1)
+        .get('/sub/foo')
+        .expect(200, 'FOO', cb)
     })
   })
 })

From da6cb0ed8a4c9a5048cf391a32f9fab1960d9284 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 15:15:41 -0500
Subject: [PATCH 277/479] tests: add range tests to res.download

---
 test/res.download.js | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/test/res.download.js b/test/res.download.js
index cf3b3ca53e1..658d80af4fc 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -20,6 +20,33 @@ describe('res', function(){
       .expect('Content-Disposition', 'attachment; filename="user.html"')
       .expect(200, '<p>{{user.name}}</p>', done)
     })
+
+    it('should accept range requests', function (done) {
+      var app = express()
+
+      app.get('/', function (req, res) {
+        res.download('test/fixtures/user.html')
+      })
+
+      request(app)
+        .get('/')
+        .expect('Accept-Ranges', 'bytes')
+        .expect(200, '<p>{{user.name}}</p>', done)
+    })
+
+    it('should respond with requested byte range', function (done) {
+      var app = express()
+
+      app.get('/', function (req, res) {
+        res.download('test/fixtures/user.html')
+      })
+
+      request(app)
+        .get('/')
+        .set('Range', 'bytes=0-2')
+        .expect('Content-Range', 'bytes 0-2/20')
+        .expect(206, '<p>', done)
+    })
   })
 
   describe('.download(path, filename)', function(){

From 744564fcf806311fdc88fb1d8b4097560d514ad7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Feb 2022 16:19:01 -0500
Subject: [PATCH 278/479] tests: add test for multiple ips in "trust proxy"

---
 test/req.ip.js | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/test/req.ip.js b/test/req.ip.js
index 1cd255216b9..23623cfce6f 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -21,7 +21,7 @@ describe('req', function(){
           .expect('client', done);
         })
 
-        it('should return the addr after trusted proxy', function(done){
+        it('should return the addr after trusted proxy based on count', function (done) {
           var app = express();
 
           app.set('trust proxy', 2);
@@ -36,6 +36,21 @@ describe('req', function(){
           .expect('p1', done);
         })
 
+        it('should return the addr after trusted proxy based on list', function (done) {
+          var app = express()
+
+          app.set('trust proxy', '10.0.0.1, 10.0.0.2, 127.0.0.1, ::1')
+
+          app.get('/', function (req, res) {
+            res.send(req.ip)
+          })
+
+          request(app)
+            .get('/')
+            .set('X-Forwarded-For', '10.0.0.2, 10.0.0.3, 10.0.0.1', '10.0.0.4')
+            .expect('10.0.0.3', done)
+        })
+
         it('should return the addr after trusted proxy, from sub app', function (done) {
           var app = express();
           var sub = express();

From 89bb531b311e2670a12dc020d69adb91327aa7e0 Mon Sep 17 00:00:00 2001
From: caioagiani <agianicaio@gmail.com>
Date: Thu, 3 Feb 2022 23:54:57 -0300
Subject: [PATCH 279/479] docs: fix typo in res.download jsdoc

closes #4805
---
 lib/response.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index 48239a475ac..ba02008522d 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -524,7 +524,7 @@ res.sendfile = deprecate.function(res.sendfile,
  * Optionally providing an alternate attachment `filename`,
  * and optional callback `callback(err)`. The callback is invoked
  * when the data transfer is complete, or when an error has
- * ocurred. Be sure to check `res.headersSent` if you plan to respond.
+ * occurred. Be sure to check `res.headersSent` if you plan to respond.
  *
  * Optionally providing an `options` object to use with `res.sendFile()`.
  * This function will set the `Content-Disposition` header, overriding

From 2bc734aa3f76db2984368134736e1ddf2d325e6a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Feb 2022 16:21:11 -0500
Subject: [PATCH 280/479] deps: accepts@~1.3.8

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 41cacce786f..57df902afe1 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+  * deps: accepts@~1.3.8
+    - deps: mime-types@~2.1.34
+    - deps: negotiator@0.6.3
+
 4.17.2 / 2021-12-16
 ===================
 
diff --git a/package.json b/package.json
index ebb7425d9ac..dc86d680cc7 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.3.7",
+    "accepts": "~1.3.8",
     "array-flatten": "1.1.1",
     "body-parser": "1.19.1",
     "content-disposition": "0.5.4",

From 6fbc269563c53297d29b69b89fd71b74c1dbd6ce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Feb 2022 16:34:56 -0500
Subject: [PATCH 281/479] pref: remove unnecessary regexp for trust proxy

---
 History.md   | 1 +
 lib/utils.js | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 57df902afe1..493ea189ffa 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * deps: accepts@~1.3.8
     - deps: mime-types@~2.1.34
     - deps: negotiator@0.6.3
+  * pref: remove unnecessary regexp for trust proxy
 
 4.17.2 / 2021-12-16
 ===================
diff --git a/lib/utils.js b/lib/utils.js
index a9ef259ff1e..7797b068530 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -228,7 +228,8 @@ exports.compileTrust = function(val) {
 
   if (typeof val === 'string') {
     // Support comma-separated values
-    val = val.split(/ *, */);
+    val = val.split(',')
+      .map(function (v) { return v.trim() })
   }
 
   return proxyaddr.compile(val || []);

From 9cbbc8ae74c63ec79b04971923493533066bf4d2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Feb 2022 16:35:50 -0500
Subject: [PATCH 282/479] deps: cookie@0.4.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 493ea189ffa..140756cd03d 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * deps: accepts@~1.3.8
     - deps: mime-types@~2.1.34
     - deps: negotiator@0.6.3
+  * deps: cookie@0.4.2
   * pref: remove unnecessary regexp for trust proxy
 
 4.17.2 / 2021-12-16
diff --git a/package.json b/package.json
index dc86d680cc7..bc24d1a4f48 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "body-parser": "1.19.1",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
-    "cookie": "0.4.1",
+    "cookie": "0.4.2",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~1.1.2",

From 1c7bbcc143296576e12ffe0fb9a35d43ede43ae7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Feb 2022 16:36:47 -0500
Subject: [PATCH 283/479] build: Node.js@14.19

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e2a4945645e..98314e57f8c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -88,7 +88,7 @@ jobs:
           node-version: "13.14"
 
         - name: Node.js 14.x
-          node-version: "14.18"
+          node-version: "14.19"
 
     steps:
     - uses: actions/checkout@v2
diff --git a/appveyor.yml b/appveyor.yml
index 785c799e8fe..01e357f1047 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -15,7 +15,7 @@ environment:
     - nodejs_version: "11.15"
     - nodejs_version: "12.22"
     - nodejs_version: "13.14"
-    - nodejs_version: "14.18"
+    - nodejs_version: "14.19"
 cache:
   - node_modules
 install:

From 43cc56eb9e529774535a992422ee90b5c9e15ff9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Feb 2022 16:48:33 -0500
Subject: [PATCH 284/479] build: clean up gitignore

---
 .gitignore | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/.gitignore b/.gitignore
index 5fee6a2dc97..a1e980205f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,27 +1,14 @@
-# OS X
-.DS_Store*
-Icon?
-._*
-
-# Windows
-Thumbs.db
-ehthumbs.db
-Desktop.ini
-
-# Linux
-.directory
-*~
-
-
 # npm
 node_modules
 package-lock.json
 *.log
 *.gz
 
-
 # Coveralls
 coverage
 
 # Benchmarking
 benchmarks/graphs
+
+# ignore additional files using core.excludesFile
+# https://git-scm.com/docs/gitignore

From 9d0976229d48c22e8f47dee6349bc4531035657f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Feb 2022 21:14:41 -0500
Subject: [PATCH 285/479] build: supertest@6.2.2

---
 .github/workflows/ci.yml |  4 +--
 appveyor.yml             |  3 ++
 package.json             |  2 +-
 test/res.sendFile.js     | 76 ++++++++++++++++++++++++----------------
 4 files changed, 52 insertions(+), 33 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98314e57f8c..c6eba737f9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -59,11 +59,11 @@ jobs:
 
         - name: Node.js 6.x
           node-version: "6.17"
-          npm-i: mocha@6.2.2
+          npm-i: mocha@6.2.2 supertest@6.1.6
 
         - name: Node.js 7.x
           node-version: "7.10"
-          npm-i: mocha@6.2.2
+          npm-i: mocha@6.2.2 supertest@6.1.6
 
         - name: Node.js 8.x
           node-version: "8.17"
diff --git a/appveyor.yml b/appveyor.yml
index 01e357f1047..ca108e24fb2 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -58,10 +58,13 @@ install:
       # supertest for http calls
       # - use 2.0.0 for Node.js < 4
       # - use 3.4.2 for Node.js < 6
+      # - use 6.1.6 for Node.js < 8
       if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev supertest@2.0.0
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
         npm install --silent --save-dev supertest@3.4.2
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 8) {
+        npm install --silent --save-dev supertest@6.1.6
       }
   # Update Node.js modules
   - ps: |
diff --git a/package.json b/package.json
index bc24d1a4f48..b3eedce29c0 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "multiparty": "4.2.2",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "6.1.6",
+    "supertest": "6.2.2",
     "vhost": "~3.0.2"
   },
   "engines": {
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 5f494f1e0bc..183faceb1d4 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -112,12 +112,11 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'));
-          server.close(cb)
           setTimeout(function () {
             cb(error)
           }, 10)
         })
-        test.abort();
+        test.req.abort()
       });
 
       app.use(function (err, req, res, next) {
@@ -127,7 +126,10 @@ describe('res', function(){
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.end()
+      test.end(function (err) {
+        assert.ok(err)
+        server.close(cb)
+      })
     })
 
     describe('with "cacheControl" option', function () {
@@ -272,43 +274,49 @@ describe('res', function(){
     })
 
     it('should invoke the callback when client aborts', function (done) {
-      var cb = after(1, done);
+      var cb = after(2, done)
       var app = express();
 
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
-            should(err).be.ok()
-            err.code.should.equal('ECONNABORTED');
-            server.close(cb)
+            assert.ok(err)
+            assert.strictEqual(err.code, 'ECONNABORTED')
+            cb()
           });
         });
-        test.abort();
+        test.req.abort()
       });
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.expect(200, cb);
+      test.end(function (err) {
+        assert.ok(err)
+        server.close(cb)
+      })
     })
 
     it('should invoke the callback when client already aborted', function (done) {
-      var cb = after(1, done);
+      var cb = after(2, done)
       var app = express();
 
       app.use(function (req, res) {
         onFinished(res, function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
-            should(err).be.ok()
-            err.code.should.equal('ECONNABORTED');
-            server.close(cb)
+            assert.ok(err)
+            assert.strictEqual(err.code, 'ECONNABORTED')
+            cb()
           });
         });
-        test.abort();
+        test.req.abort()
       });
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.expect(200, cb);
+      test.end(function (err) {
+        assert.ok(err)
+        server.close(cb)
+      })
     })
 
     it('should invoke the callback without error when HEAD', function (done) {
@@ -398,43 +406,49 @@ describe('res', function(){
     })
 
     it('should invoke the callback when client aborts', function (done) {
-      var cb = after(1, done);
+      var cb = after(2, done)
       var app = express();
 
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendfile('test/fixtures/name.txt', function (err) {
-            should(err).be.ok()
-            err.code.should.equal('ECONNABORTED');
-            server.close(cb)
+            assert.ok(err)
+            assert.strictEqual(err.code, 'ECONNABORTED')
+            cb()
           });
         });
-        test.abort();
+        test.req.abort()
       });
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.expect(200, cb);
+      test.end(function (err) {
+        assert.ok(err)
+        server.close(cb)
+      })
     })
 
     it('should invoke the callback when client already aborted', function (done) {
-      var cb = after(1, done);
+      var cb = after(2, done)
       var app = express();
 
       app.use(function (req, res) {
         onFinished(res, function () {
           res.sendfile('test/fixtures/name.txt', function (err) {
-            should(err).be.ok()
-            err.code.should.equal('ECONNABORTED');
-            server.close(cb)
+            assert.ok(err)
+            assert.strictEqual(err.code, 'ECONNABORTED')
+            cb()
           });
         });
-        test.abort();
+        test.req.abort()
       });
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.expect(200, cb);
+      test.end(function (err) {
+        assert.ok(err)
+        server.close(cb)
+      })
     })
 
     it('should invoke the callback without error when HEAD', function (done) {
@@ -652,12 +666,11 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendfile(path.resolve(fixtures, 'name.txt'));
-          server.close(cb)
           setTimeout(function () {
             cb(error)
           }, 10)
         });
-        test.abort();
+        test.req.abort()
       });
 
       app.use(function (err, req, res, next) {
@@ -667,7 +680,10 @@ describe('res', function(){
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.end()
+      test.end(function (err) {
+        assert.ok(err)
+        server.close(cb)
+      })
     })
 
     describe('with an absolute path', function(){

From 2585f209f98f91da68739bdb33b599df45b3a6e6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Feb 2022 21:18:47 -0500
Subject: [PATCH 286/479] tests: fix test missing assertion

---
 test/res.download.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/res.download.js b/test/res.download.js
index 658d80af4fc..579f8c67a9f 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -88,7 +88,7 @@ describe('res', function(){
       var cb = after(2, done);
 
       app.use(function(req, res){
-        res.download('test/fixtures/user.html', 'document', done);
+        res.download('test/fixtures/user.html', 'document', cb)
       });
 
       request(app)

From 7511d083283529f865ade6fedac08716f0efde05 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 7 Feb 2022 17:46:47 -0500
Subject: [PATCH 287/479] build: use minimatch@3.0.4 for Node.js < 4

---
 .github/workflows/ci.yml | 10 +++++-----
 appveyor.yml             |  5 +++++
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c6eba737f9d..416ece09597 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,23 +31,23 @@ jobs:
         include:
         - name: Node.js 0.10
           node-version: "0.10"
-          npm-i: mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
 
         - name: Node.js 0.12
           node-version: "0.12"
-          npm-i: mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
 
         - name: io.js 1.x
           node-version: "1.8"
-          npm-i: mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
 
         - name: io.js 2.x
           node-version: "2.5"
-          npm-i: mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
 
         - name: io.js 3.x
           node-version: "3.3"
-          npm-i: mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
 
         - name: Node.js 4.x
           node-version: "4.9"
diff --git a/appveyor.yml b/appveyor.yml
index ca108e24fb2..c1b51ca7cd4 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -36,6 +36,11 @@ install:
         sls "^eslint(-|$)" | `
         %{ npm rm --silent --save-dev $_ }
   # Setup Node.js version-specific dependencies
+  - ps: |
+      # minimatch for Node.js < 4
+      if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
+        npm install --silent --save-dev minimatch@3.0.4
+      }
   - ps: |
       # mocha for testing
       # - use 3.x for Node.js < 4

From 884657d54665f323c236055d6e3d3e85d96e5f08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Strau=C3=9F?=
 <49093997+thst71@users.noreply.github.com>
Date: Sun, 6 Feb 2022 16:59:17 +0100
Subject: [PATCH 288/479] examples: remove bitwise syntax for includes check

closes #4814
---
 examples/web-service/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index c22fea40323..a2cd2cb7f90 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -34,7 +34,7 @@ app.use('/api', function(req, res, next){
   if (!key) return next(error(400, 'api key required'));
 
   // key is invalid
-  if (!~apiKeys.indexOf(key)) return next(error(401, 'invalid api key'));
+  if (apiKeys.indexOf(key) === -1) return next(error(401, 'invalid api key'))
 
   // all good, store req.key for route access
   req.key = key;

From 12310c52947ee159f7ecd63d125243cdca891135 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 7 Feb 2022 23:08:12 -0500
Subject: [PATCH 289/479] build: use nyc for test coverage

---
 .github/workflows/ci.yml | 18 +++++++++---------
 .gitignore               |  1 +
 appveyor.yml             | 12 ++++++++++++
 package.json             |  6 +++---
 4 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 416ece09597..30da0e25c33 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,39 +31,39 @@ jobs:
         include:
         - name: Node.js 0.10
           node-version: "0.10"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 0.12
           node-version: "0.12"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 1.x
           node-version: "1.8"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 2.x
           node-version: "2.5"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 3.x
           node-version: "3.3"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 supertest@2.0.0
+          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 4.x
           node-version: "4.9"
-          npm-i: mocha@5.2.0 supertest@3.4.2
+          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
 
         - name: Node.js 5.x
           node-version: "5.12"
-          npm-i: mocha@5.2.0 supertest@3.4.2
+          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
 
         - name: Node.js 6.x
           node-version: "6.17"
-          npm-i: mocha@6.2.2 supertest@6.1.6
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 7.x
           node-version: "7.10"
-          npm-i: mocha@6.2.2 supertest@6.1.6
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 8.x
           node-version: "8.17"
diff --git a/.gitignore b/.gitignore
index a1e980205f9..3a673d9cc09 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@ package-lock.json
 *.gz
 
 # Coveralls
+.nyc_output
 coverage
 
 # Benchmarking
diff --git a/appveyor.yml b/appveyor.yml
index c1b51ca7cd4..1052be0097d 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -59,6 +59,18 @@ install:
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 12) {
         npm install --silent --save-dev mocha@8.4.0
       }
+  - ps: |
+      # nyc for test coverage
+      # - use 10.3.2 for Node.js < 4
+      # - use 11.9.0 for Node.js < 6
+      # - use 14.1.1 for Node.js < 8
+      if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
+        npm install --silent --save-dev nyc@10.3.2
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
+        npm install --silent --save-dev nyc@11.9.0
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 8) {
+        npm install --silent --save-dev nyc@14.1.1
+      }
   - ps: |
       # supertest for http calls
       # - use 2.0.0 for Node.js < 4
diff --git a/package.json b/package.json
index b3eedce29c0..daa2f0d3a1f 100644
--- a/package.json
+++ b/package.json
@@ -68,12 +68,12 @@
     "eslint": "7.32.0",
     "express-session": "1.17.2",
     "hbs": "4.2.0",
-    "istanbul": "0.4.5",
     "marked": "0.7.0",
     "method-override": "3.0.0",
     "mocha": "9.2.0",
     "morgan": "1.10.0",
     "multiparty": "4.2.2",
+    "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
     "supertest": "6.2.2",
@@ -92,8 +92,8 @@
   "scripts": {
     "lint": "eslint .",
     "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
+    "test-cov": "nyc --reporter=html --reporter=text npm test",
     "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"
   }
 }

From 82de4de5ab92e8237d713285104e4b8452927352 Mon Sep 17 00:00:00 2001
From: KoyamaSohei <koyamaso0309@gmail.com>
Date: Fri, 13 Dec 2019 14:38:56 +0900
Subject: [PATCH 290/479] examples: fix path traversal in downloads example

closes #4120
---
 examples/downloads/index.js  | 7 ++++++-
 package.json                 | 1 +
 test/acceptance/downloads.js | 8 ++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/examples/downloads/index.js b/examples/downloads/index.js
index 91c52bb87ca..62e7fa6e3eb 100644
--- a/examples/downloads/index.js
+++ b/examples/downloads/index.js
@@ -6,8 +6,13 @@
 
 var express = require('../../');
 var path = require('path');
+var resolvePath = require('resolve-path')
+
 var app = module.exports = express();
 
+// path to where the files are stored on disk
+var FILES_DIR = path.join(__dirname, 'files')
+
 app.get('/', function(req, res){
   res.send('<ul>' +
     '<li>Download <a href="/files/notes/groceries.txt">notes/groceries.txt</a>.</li>' +
@@ -20,7 +25,7 @@ app.get('/', function(req, res){
 // /files/* is accessed via req.params[0]
 // but here we name it :file
 app.get('/files/:file(*)', function(req, res, next){
-  var filePath = path.join(__dirname, 'files', req.params.file);
+  var filePath = resolvePath(FILES_DIR, req.params.file)
 
   res.download(filePath, function (err) {
     if (!err) return; // file sent
diff --git a/package.json b/package.json
index daa2f0d3a1f..fe5d07553fd 100644
--- a/package.json
+++ b/package.json
@@ -75,6 +75,7 @@
     "multiparty": "4.2.2",
     "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
+    "resolve-path": "1.4.0",
     "should": "13.2.3",
     "supertest": "6.2.2",
     "vhost": "~3.0.2"
diff --git a/test/acceptance/downloads.js b/test/acceptance/downloads.js
index ae44388354f..6db43b351e4 100644
--- a/test/acceptance/downloads.js
+++ b/test/acceptance/downloads.js
@@ -36,4 +36,12 @@ describe('downloads', function(){
       .expect(404, done)
     })
   })
+
+  describe('GET /files/../index.js', function () {
+    it('should respond with 403', function (done) {
+      request(app)
+        .get('/files/../index.js')
+        .expect(403, done)
+    })
+  })
 })

From a39e409cf3739ef9c9b597a9680813a34c3931c2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 8 Feb 2022 18:40:07 -0500
Subject: [PATCH 291/479] tests: prevent leaking changes to NODE_ENV

---
 test/app.js | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/test/app.js b/test/app.js
index d0756795d3c..70f72de7c73 100644
--- a/test/app.js
+++ b/test/app.js
@@ -83,28 +83,49 @@ describe('app.path()', function(){
 })
 
 describe('in development', function(){
+  before(function () {
+    this.env = process.env.NODE_ENV
+    process.env.NODE_ENV = 'development'
+  })
+
+  after(function () {
+    process.env.NODE_ENV = this.env
+  })
+
   it('should disable "view cache"', function(){
-    process.env.NODE_ENV = 'development';
     var app = express();
     assert.ok(!app.enabled('view cache'))
-    process.env.NODE_ENV = 'test';
   })
 })
 
 describe('in production', function(){
+  before(function () {
+    this.env = process.env.NODE_ENV
+    process.env.NODE_ENV = 'production'
+  })
+
+  after(function () {
+    process.env.NODE_ENV = this.env
+  })
+
   it('should enable "view cache"', function(){
-    process.env.NODE_ENV = 'production';
     var app = express();
     assert.ok(app.enabled('view cache'))
-    process.env.NODE_ENV = 'test';
   })
 })
 
 describe('without NODE_ENV', function(){
+  before(function () {
+    this.env = process.env.NODE_ENV
+    process.env.NODE_ENV = ''
+  })
+
+  after(function () {
+    process.env.NODE_ENV = this.env
+  })
+
   it('should default to development', function(){
-    process.env.NODE_ENV = '';
     var app = express();
     assert.strictEqual(app.get('env'), 'development')
-    process.env.NODE_ENV = 'test';
   })
 })

From a65913776d0b16837364ee66caa1a7f38a9997c0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 9 Feb 2022 01:07:08 -0500
Subject: [PATCH 292/479] tests: use strict mode

---
 test/Route.js                | 1 +
 test/Router.js               | 1 +
 test/app.all.js              | 1 +
 test/app.del.js              | 1 +
 test/app.engine.js           | 1 +
 test/app.head.js             | 1 +
 test/app.js                  | 1 +
 test/app.listen.js           | 1 +
 test/app.locals.js           | 1 +
 test/app.options.js          | 1 +
 test/app.param.js            | 1 +
 test/app.render.js           | 1 +
 test/app.request.js          | 1 +
 test/app.response.js         | 1 +
 test/app.route.js            | 2 ++
 test/app.router.js           | 1 +
 test/app.routes.error.js     | 1 +
 test/app.use.js              | 1 +
 test/config.js               | 1 +
 test/exports.js              | 1 +
 test/express.json.js         | 1 +
 test/express.raw.js          | 1 +
 test/express.static.js       | 1 +
 test/express.text.js         | 1 +
 test/express.urlencoded.js   | 1 +
 test/middleware.basic.js     | 1 +
 test/regression.js           | 1 +
 test/req.accepts.js          | 1 +
 test/req.acceptsCharset.js   | 1 +
 test/req.acceptsCharsets.js  | 1 +
 test/req.acceptsEncoding.js  | 1 +
 test/req.acceptsEncodings.js | 1 +
 test/req.acceptsLanguage.js  | 1 +
 test/req.acceptsLanguages.js | 1 +
 test/req.baseUrl.js          | 1 +
 test/req.fresh.js            | 1 +
 test/req.get.js              | 1 +
 test/req.host.js             | 1 +
 test/req.hostname.js         | 1 +
 test/req.ip.js               | 1 +
 test/req.ips.js              | 1 +
 test/req.is.js               | 1 +
 test/req.param.js            | 1 +
 test/req.path.js             | 1 +
 test/req.protocol.js         | 1 +
 test/req.query.js            | 1 +
 test/req.range.js            | 1 +
 test/req.route.js            | 1 +
 test/req.secure.js           | 1 +
 test/req.signedCookies.js    | 1 +
 test/req.stale.js            | 1 +
 test/req.subdomains.js       | 1 +
 test/req.xhr.js              | 1 +
 test/res.append.js           | 1 +
 test/res.attachment.js       | 1 +
 test/res.clearCookie.js      | 1 +
 test/res.cookie.js           | 1 +
 test/res.download.js         | 1 +
 test/res.format.js           | 1 +
 test/res.get.js              | 1 +
 test/res.json.js             | 1 +
 test/res.jsonp.js            | 1 +
 test/res.links.js            | 1 +
 test/res.locals.js           | 1 +
 test/res.location.js         | 1 +
 test/res.redirect.js         | 1 +
 test/res.render.js           | 1 +
 test/res.send.js             | 1 +
 test/res.sendFile.js         | 1 +
 test/res.sendStatus.js       | 1 +
 test/res.set.js              | 1 +
 test/res.status.js           | 1 +
 test/res.type.js             | 1 +
 test/res.vary.js             | 1 +
 test/utils.js                | 1 +
 75 files changed, 76 insertions(+)

diff --git a/test/Route.js b/test/Route.js
index 8f90152d8c8..005b4634e9a 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after');
 var should = require('should');
diff --git a/test/Router.js b/test/Router.js
index 16522f6aa86..907b9726361 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after');
 var express = require('../')
diff --git a/test/app.all.js b/test/app.all.js
index 45c3ddb93bd..185a8332fe7 100644
--- a/test/app.all.js
+++ b/test/app.all.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after')
 var express = require('../')
diff --git a/test/app.del.js b/test/app.del.js
index d419fbb1580..e9e5769d658 100644
--- a/test/app.del.js
+++ b/test/app.del.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/app.engine.js b/test/app.engine.js
index 0d54c90d563..214510a94c0 100644
--- a/test/app.engine.js
+++ b/test/app.engine.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('../')
diff --git a/test/app.head.js b/test/app.head.js
index 6aa1bb8003f..fabb98795ab 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../');
 var request = require('supertest');
diff --git a/test/app.js b/test/app.js
index 70f72de7c73..6134717c33e 100644
--- a/test/app.js
+++ b/test/app.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('..')
diff --git a/test/app.listen.js b/test/app.listen.js
index 9d54ca5244d..08eeaaa63c2 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
 
diff --git a/test/app.locals.js b/test/app.locals.js
index 0b14ac90704..88f83c94831 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('../')
diff --git a/test/app.options.js b/test/app.options.js
index 9c88abafe5e..fdfd38c8a28 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/app.param.js b/test/app.param.js
index 7dbe3ffb610..8893851f9d5 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('../')
diff --git a/test/app.render.js b/test/app.render.js
index d0b367189b0..9d202acfdda 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('..');
diff --git a/test/app.request.js b/test/app.request.js
index 0288f80b097..4930af84c25 100644
--- a/test/app.request.js
+++ b/test/app.request.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after')
 var express = require('../')
diff --git a/test/app.response.js b/test/app.response.js
index ea696b566f1..5fb69f6275a 100644
--- a/test/app.response.js
+++ b/test/app.response.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after')
 var express = require('../')
diff --git a/test/app.route.js b/test/app.route.js
index 75e5e0b8421..eaf8a120515 100644
--- a/test/app.route.js
+++ b/test/app.route.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var express = require('../');
 var request = require('supertest');
 
diff --git a/test/app.router.js b/test/app.router.js
index 8c98aa869b2..3069a22c772 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after');
 var express = require('../')
diff --git a/test/app.routes.error.js b/test/app.routes.error.js
index b1f95d0d6e0..56081b31127 100644
--- a/test/app.routes.error.js
+++ b/test/app.routes.error.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('../')
diff --git a/test/app.use.js b/test/app.use.js
index 55ba0689c8d..fd9b1751a31 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after');
 var assert = require('assert')
diff --git a/test/config.js b/test/config.js
index 17a02b7ebab..8386a4471c3 100644
--- a/test/config.js
+++ b/test/config.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert');
 var express = require('..');
diff --git a/test/exports.js b/test/exports.js
index 7624a8c8641..98d79365943 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('../');
diff --git a/test/express.json.js b/test/express.json.js
index 907fa0cfeb8..53a39565a9b 100644
--- a/test/express.json.js
+++ b/test/express.json.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var Buffer = require('safe-buffer').Buffer
diff --git a/test/express.raw.js b/test/express.raw.js
index 571c29ca9bc..cbd0736e7cb 100644
--- a/test/express.raw.js
+++ b/test/express.raw.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var Buffer = require('safe-buffer').Buffer
diff --git a/test/express.static.js b/test/express.static.js
index 56d3657bff0..245fd5929cc 100644
--- a/test/express.static.js
+++ b/test/express.static.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var Buffer = require('safe-buffer').Buffer
diff --git a/test/express.text.js b/test/express.text.js
index 7c92f90e5aa..ebc12cd1098 100644
--- a/test/express.text.js
+++ b/test/express.text.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var Buffer = require('safe-buffer').Buffer
diff --git a/test/express.urlencoded.js b/test/express.urlencoded.js
index 6011de05f7a..340eb74316c 100644
--- a/test/express.urlencoded.js
+++ b/test/express.urlencoded.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var Buffer = require('safe-buffer').Buffer
diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index 4616842ed60..19f00d9a296 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('../');
diff --git a/test/regression.js b/test/regression.js
index 5d4509ed6fb..4e99b306948 100644
--- a/test/regression.js
+++ b/test/regression.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.accepts.js b/test/req.accepts.js
index 0df4780e221..2066fb51859 100644
--- a/test/req.accepts.js
+++ b/test/req.accepts.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.acceptsCharset.js b/test/req.acceptsCharset.js
index f7d0cc0e300..6dbab439b7e 100644
--- a/test/req.acceptsCharset.js
+++ b/test/req.acceptsCharset.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.acceptsCharsets.js b/test/req.acceptsCharsets.js
index d1c459174a9..360a9878a78 100644
--- a/test/req.acceptsCharsets.js
+++ b/test/req.acceptsCharsets.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.acceptsEncoding.js b/test/req.acceptsEncoding.js
index f2af68da22a..bcec2280e65 100644
--- a/test/req.acceptsEncoding.js
+++ b/test/req.acceptsEncoding.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
index dc21c4edda1..c36934290a1 100644
--- a/test/req.acceptsEncodings.js
+++ b/test/req.acceptsEncodings.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.acceptsLanguage.js b/test/req.acceptsLanguage.js
index 616e7239460..816be244eb1 100644
--- a/test/req.acceptsLanguage.js
+++ b/test/req.acceptsLanguage.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.acceptsLanguages.js b/test/req.acceptsLanguages.js
index 87bf7b25df1..e5629fbc323 100644
--- a/test/req.acceptsLanguages.js
+++ b/test/req.acceptsLanguages.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.baseUrl.js b/test/req.baseUrl.js
index 9ac9d88029b..b70803ea8bb 100644
--- a/test/req.baseUrl.js
+++ b/test/req.baseUrl.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..')
 var request = require('supertest')
diff --git a/test/req.fresh.js b/test/req.fresh.js
index 1aa8fa5b217..9160e2caaf6 100644
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.get.js b/test/req.get.js
index 109a2d90ce7..16589b3f059 100644
--- a/test/req.get.js
+++ b/test/req.get.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest')
diff --git a/test/req.host.js b/test/req.host.js
index 7bb0b27acf8..2c051fb9791 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest')
diff --git a/test/req.hostname.js b/test/req.hostname.js
index 09bfb899898..b3716b566ae 100644
--- a/test/req.hostname.js
+++ b/test/req.hostname.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest')
diff --git a/test/req.ip.js b/test/req.ip.js
index 23623cfce6f..6bb3c5ac52f 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.ips.js b/test/req.ips.js
index a7d464b8468..2f9a0736ea3 100644
--- a/test/req.ips.js
+++ b/test/req.ips.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.is.js b/test/req.is.js
index a2fce178673..c5904dd600a 100644
--- a/test/req.is.js
+++ b/test/req.is.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..')
 var request = require('supertest')
diff --git a/test/req.param.js b/test/req.param.js
index 89f0295cd9d..b3748c02bce 100644
--- a/test/req.param.js
+++ b/test/req.param.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest')
diff --git a/test/req.path.js b/test/req.path.js
index 6ad4009c7d5..3ff6177c74e 100644
--- a/test/req.path.js
+++ b/test/req.path.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.protocol.js b/test/req.protocol.js
index 453ad11ca4a..61f76356b4c 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.query.js b/test/req.query.js
index f3e8df8a188..6fae592dccc 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('../')
diff --git a/test/req.range.js b/test/req.range.js
index 5443c0658d2..111441736eb 100644
--- a/test/req.range.js
+++ b/test/req.range.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..');
 var request = require('supertest')
diff --git a/test/req.route.js b/test/req.route.js
index b32d470bd6a..6c17fbb1c8f 100644
--- a/test/req.route.js
+++ b/test/req.route.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.secure.js b/test/req.secure.js
index 2025c8786b6..0097ed6136e 100644
--- a/test/req.secure.js
+++ b/test/req.secure.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index a55f81b22c5..db561951665 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest')
diff --git a/test/req.stale.js b/test/req.stale.js
index 30c9d05d51c..cda77fa403e 100644
--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.subdomains.js b/test/req.subdomains.js
index 18e4d80ad32..e5600f2eb56 100644
--- a/test/req.subdomains.js
+++ b/test/req.subdomains.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/req.xhr.js b/test/req.xhr.js
index 3ad1c6fb726..99cf7f1917d 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/res.append.js b/test/res.append.js
index f7f1d55b3cb..5b12e35b696 100644
--- a/test/res.append.js
+++ b/test/res.append.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..')
 var request = require('supertest')
diff --git a/test/res.attachment.js b/test/res.attachment.js
index 4c3d4aa2f1b..6283ded0d65 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var Buffer = require('safe-buffer').Buffer
 var express = require('../')
diff --git a/test/res.clearCookie.js b/test/res.clearCookie.js
index 4822057e926..fc0cfb99a3d 100644
--- a/test/res.clearCookie.js
+++ b/test/res.clearCookie.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/res.cookie.js b/test/res.cookie.js
index 8f8662c217a..d10e48646b6 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest')
diff --git a/test/res.download.js b/test/res.download.js
index 579f8c67a9f..ce0ee088ba0 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after');
 var assert = require('assert');
diff --git a/test/res.format.js b/test/res.format.js
index 076b78d7386..24e18d95528 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after')
 var express = require('../')
diff --git a/test/res.get.js b/test/res.get.js
index a53bdc33805..a5f12e2e539 100644
--- a/test/res.get.js
+++ b/test/res.get.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..');
 var request = require('supertest');
diff --git a/test/res.json.js b/test/res.json.js
index 59227a830b8..dcaceae5ca4 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest')
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 3444d5138b5..0735d43bd50 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest')
diff --git a/test/res.links.js b/test/res.links.js
index 36630c9ccc5..240b7fcfda3 100644
--- a/test/res.links.js
+++ b/test/res.links.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..');
 var request = require('supertest');
diff --git a/test/res.locals.js b/test/res.locals.js
index a1c819667a3..c4365b36f35 100644
--- a/test/res.locals.js
+++ b/test/res.locals.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/res.location.js b/test/res.location.js
index c0bfbe8c8ec..158afac01e7 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/res.redirect.js b/test/res.redirect.js
index c07df5dd2c4..be7c773bee0 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var express = require('..');
diff --git a/test/res.render.js b/test/res.render.js
index 643a57002a0..50f0b0a7425 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..');
 var path = require('path')
diff --git a/test/res.send.js b/test/res.send.js
index e62caf95dc1..8f849f8069b 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert')
 var Buffer = require('safe-buffer').Buffer
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 183faceb1d4..c7fc93a76d3 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var after = require('after');
 var Buffer = require('safe-buffer').Buffer
diff --git a/test/res.sendStatus.js b/test/res.sendStatus.js
index c355bc408f3..9b1de8385cd 100644
--- a/test/res.sendStatus.js
+++ b/test/res.sendStatus.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..')
 var request = require('supertest')
diff --git a/test/res.set.js b/test/res.set.js
index e46d123947a..04511c1c95f 100644
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..');
 var request = require('supertest');
diff --git a/test/res.status.js b/test/res.status.js
index 8c173a645c5..e0abc73c4c0 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/res.type.js b/test/res.type.js
index cc1dd08d410..980717a6e30 100644
--- a/test/res.type.js
+++ b/test/res.type.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('../')
   , request = require('supertest');
diff --git a/test/res.vary.js b/test/res.vary.js
index 9d39a341c0b..1efc20b4453 100644
--- a/test/res.vary.js
+++ b/test/res.vary.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var express = require('..');
 var request = require('supertest');
diff --git a/test/utils.js b/test/utils.js
index a0fac7a722c..f0cb3c37619 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -1,3 +1,4 @@
+'use strict'
 
 var assert = require('assert');
 var Buffer = require('safe-buffer').Buffer

From e98f5848a0a496c0977a2d1734067b77f69de360 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Feb 2022 18:42:47 -0500
Subject: [PATCH 293/479] Revert "build: use minimatch@3.0.4 for Node.js < 4"

---
 .github/workflows/ci.yml | 10 +++++-----
 appveyor.yml             |  5 -----
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30da0e25c33..d6e1b168ec1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,23 +31,23 @@ jobs:
         include:
         - name: Node.js 0.10
           node-version: "0.10"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 0.12
           node-version: "0.12"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 1.x
           node-version: "1.8"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 2.x
           node-version: "2.5"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 3.x
           node-version: "3.3"
-          npm-i: minimatch@3.0.4 mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 4.x
           node-version: "4.9"
diff --git a/appveyor.yml b/appveyor.yml
index 1052be0097d..db54a3fdb04 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -36,11 +36,6 @@ install:
         sls "^eslint(-|$)" | `
         %{ npm rm --silent --save-dev $_ }
   # Setup Node.js version-specific dependencies
-  - ps: |
-      # minimatch for Node.js < 4
-      if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
-        npm install --silent --save-dev minimatch@3.0.4
-      }
   - ps: |
       # mocha for testing
       # - use 3.x for Node.js < 4

From a00786309641731661edb4d826a6919330887ca7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 15 Feb 2022 23:43:41 -0500
Subject: [PATCH 294/479] deps: body-parser@1.19.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 140756cd03d..2550cba59b1 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,10 @@ unreleased
   * deps: accepts@~1.3.8
     - deps: mime-types@~2.1.34
     - deps: negotiator@0.6.3
+  * deps: body-parser@1.19.2
+    - deps: bytes@3.1.2
+    - deps: qs@6.9.7
+    - deps: raw-body@2.4.3
   * deps: cookie@0.4.2
   * pref: remove unnecessary regexp for trust proxy
 
diff --git a/package.json b/package.json
index fe5d07553fd..a028b3896cd 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
   "dependencies": {
     "accepts": "~1.3.8",
     "array-flatten": "1.1.1",
-    "body-parser": "1.19.1",
+    "body-parser": "1.19.2",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
     "cookie": "0.4.2",

From 6381bc6317ec8ffbf830e2d16677e4b5af37cc08 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Feb 2022 00:03:16 -0500
Subject: [PATCH 295/479] deps: qs@6.9.7

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2550cba59b1..e57f098a9f2 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@ unreleased
     - deps: qs@6.9.7
     - deps: raw-body@2.4.3
   * deps: cookie@0.4.2
+  * deps: qs@6.9.7
+    * Fix handling of `__proto__` keys
   * pref: remove unnecessary regexp for trust proxy
 
 4.17.2 / 2021-12-16
diff --git a/package.json b/package.json
index a028b3896cd..4816ae1b4a3 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.7",
-    "qs": "6.9.6",
+    "qs": "6.9.7",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
     "send": "0.17.2",

From f9063712e01979588818b0756851053b5ee43d09 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Feb 2022 00:11:24 -0500
Subject: [PATCH 296/479] build: update example dependencies

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4816ae1b4a3..2ff077f8330 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "method-override": "3.0.0",
     "mocha": "9.2.0",
     "morgan": "1.10.0",
-    "multiparty": "4.2.2",
+    "multiparty": "4.2.3",
     "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
     "resolve-path": "1.4.0",

From 3d7fce56a35f4f73fa437866cd1401587a212334 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Feb 2022 21:03:42 -0500
Subject: [PATCH 297/479] 4.17.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index e57f098a9f2..9f3f876512d 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.17.3 / 2022-02-16
+===================
 
   * deps: accepts@~1.3.8
     - deps: mime-types@~2.1.34
diff --git a/package.json b/package.json
index 2ff077f8330..2fb6ebaab0b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.17.2",
+  "version": "4.17.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 8ee3420f0fa064fe8bd6476492cc928f1833f90e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 20 Feb 2022 23:43:02 -0500
Subject: [PATCH 298/479] tests: fix req.acceptsEncodings tests

---
 test/req.acceptsEncodings.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
index c36934290a1..9f8973cdfb8 100644
--- a/test/req.acceptsEncodings.js
+++ b/test/req.acceptsEncodings.js
@@ -10,8 +10,8 @@ describe('req', function(){
 
       app.get('/', function (req, res) {
         res.send({
-          gzip: req.acceptsEncoding('gzip'),
-          deflate: req.acceptsEncoding('deflate')
+          gzip: req.acceptsEncodings('gzip'),
+          deflate: req.acceptsEncodings('deflate')
         })
       })
 
@@ -26,7 +26,7 @@ describe('req', function(){
 
       app.get('/', function (req, res) {
         res.send({
-          bogus: req.acceptsEncoding('bogus')
+          bogus: req.acceptsEncodings('bogus')
         })
       })
 

From d8ed591117295f528c59d0f0367064ffde96d427 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 20 Feb 2022 23:49:42 -0500
Subject: [PATCH 299/479] tests: fix req.acceptsLanguage tests

---
 test/req.acceptsLanguage.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/test/req.acceptsLanguage.js b/test/req.acceptsLanguage.js
index 816be244eb1..39bd73c4834 100644
--- a/test/req.acceptsLanguage.js
+++ b/test/req.acceptsLanguage.js
@@ -10,8 +10,8 @@ describe('req', function(){
 
       app.get('/', function (req, res) {
         res.send({
-          'en-us': req.acceptsLanguages('en-us'),
-          en: req.acceptsLanguages('en')
+          'en-us': req.acceptsLanguage('en-us'),
+          en: req.acceptsLanguage('en')
         })
       })
 
@@ -26,7 +26,7 @@ describe('req', function(){
 
       app.get('/', function (req, res) {
         res.send({
-          es: req.acceptsLanguages('es')
+          es: req.acceptsLanguage('es')
         })
       })
 
@@ -42,9 +42,9 @@ describe('req', function(){
 
         app.get('/', function (req, res) {
           res.send({
-            en: req.acceptsLanguages('en'),
-            es: req.acceptsLanguages('es'),
-            jp: req.acceptsLanguages('jp')
+            en: req.acceptsLanguage('en'),
+            es: req.acceptsLanguage('es'),
+            jp: req.acceptsLanguage('jp')
           })
         })
 

From 7df0c840e07d17a2268a2ab18e6db7656b203b78 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 21 Feb 2022 19:07:26 -0500
Subject: [PATCH 300/479] tests: fix up app.locals tests

---
 test/app.locals.js | 32 ++++++++++++++------------------
 1 file changed, 14 insertions(+), 18 deletions(-)

diff --git a/test/app.locals.js b/test/app.locals.js
index 88f83c94831..657b4b75c79 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -2,28 +2,24 @@
 
 var assert = require('assert')
 var express = require('../')
-var should = require('should')
 
 describe('app', function(){
-  describe('.locals(obj)', function(){
-    it('should merge locals', function(){
-      var app = express();
-      should(Object.keys(app.locals)).eql(['settings'])
-      app.locals.user = 'tobi';
-      app.locals.age = 2;
-      should(Object.keys(app.locals)).eql(['settings', 'user', 'age'])
-      assert.strictEqual(app.locals.user, 'tobi')
-      assert.strictEqual(app.locals.age, 2)
+  describe('.locals', function () {
+    it('should default object', function () {
+      var app = express()
+      assert.ok(app.locals)
+      assert.strictEqual(typeof app.locals, 'object')
     })
-  })
 
-  describe('.locals.settings', function(){
-    it('should expose app settings', function(){
-      var app = express();
-      app.set('title', 'House of Manny');
-      var obj = app.locals.settings;
-      should(obj).have.property('env', 'test')
-      should(obj).have.property('title', 'House of Manny')
+    describe('.settings', function () {
+      it('should contain app settings ', function () {
+        var app = express()
+        app.set('title', 'Express')
+        assert.ok(app.locals.settings)
+        assert.strictEqual(typeof app.locals.settings, 'object')
+        assert.strictEqual(app.locals.settings, app.settings)
+        assert.strictEqual(app.locals.settings.title, 'Express')
+      })
     })
   })
 })

From 9967ffbdc2b90fd651e2a687fabc0d53a1065f82 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 21 Feb 2022 19:23:25 -0500
Subject: [PATCH 301/479] tests: update res.append to verify separate header
 lines

---
 test/res.append.js | 71 ++++++++++++++++++++++++++--------------------
 1 file changed, 41 insertions(+), 30 deletions(-)

diff --git a/test/res.append.js b/test/res.append.js
index 5b12e35b696..8f72598bf52 100644
--- a/test/res.append.js
+++ b/test/res.append.js
@@ -1,31 +1,29 @@
 'use strict'
 
+var assert = require('assert')
 var express = require('..')
 var request = require('supertest')
-var should = require('should')
 
 describe('res', function () {
-  // note about these tests: "Link" and "X-*" are chosen because
-  // the common node.js versions white list which _incoming_
-  // headers can appear multiple times; there is no such white list
-  // for outgoing, though
   describe('.append(field, val)', function () {
     it('should append multiple headers', function (done) {
       var app = express()
 
       app.use(function (req, res, next) {
-        res.append('Link', '<http://localhost/>')
+        res.append('Set-Cookie', 'foo=bar')
         next()
       })
 
       app.use(function (req, res) {
-        res.append('Link', '<http://localhost:80/>')
+        res.append('Set-Cookie', 'fizz=buzz')
         res.end()
       })
 
       request(app)
-      .get('/')
-      .expect('Link', '<http://localhost/>, <http://localhost:80/>', done)
+        .get('/')
+        .expect(200)
+        .expect(shouldHaveHeaderValues('Set-Cookie', ['foo=bar', 'fizz=buzz']))
+        .end(done)
     })
 
     it('should accept array of values', function (done) {
@@ -37,51 +35,54 @@ describe('res', function () {
       })
 
       request(app)
-      .get('/')
-      .expect(function (res) {
-        should(res.headers['set-cookie']).eql(['foo=bar', 'fizz=buzz'])
-      })
-      .expect(200, done)
+        .get('/')
+        .expect(200)
+        .expect(shouldHaveHeaderValues('Set-Cookie', ['foo=bar', 'fizz=buzz']))
+        .end(done)
     })
 
     it('should get reset by res.set(field, val)', function (done) {
       var app = express()
 
       app.use(function (req, res, next) {
-        res.append('Link', '<http://localhost/>')
-        res.append('Link', '<http://localhost:80/>')
+        res.append('Set-Cookie', 'foo=bar')
+        res.append('Set-Cookie', 'fizz=buzz')
         next()
       })
 
       app.use(function (req, res) {
-        res.set('Link', '<http://127.0.0.1/>')
+        res.set('Set-Cookie', 'pet=tobi')
         res.end()
       });
 
       request(app)
-      .get('/')
-      .expect('Link', '<http://127.0.0.1/>', done)
+        .get('/')
+        .expect(200)
+        .expect(shouldHaveHeaderValues('Set-Cookie', ['pet=tobi']))
+        .end(done)
     })
 
     it('should work with res.set(field, val) first', function (done) {
       var app = express()
 
       app.use(function (req, res, next) {
-        res.set('Link', '<http://localhost/>')
+        res.set('Set-Cookie', 'foo=bar')
         next()
       })
 
       app.use(function(req, res){
-        res.append('Link', '<http://localhost:80/>')
+        res.append('Set-Cookie', 'fizz=buzz')
         res.end()
       })
 
       request(app)
-      .get('/')
-      .expect('Link', '<http://localhost/>, <http://localhost:80/>', done)
+        .get('/')
+        .expect(200)
+        .expect(shouldHaveHeaderValues('Set-Cookie', ['foo=bar', 'fizz=buzz']))
+        .end(done)
     })
 
-    it('should work with cookies', function (done) {
+    it('should work together with res.cookie', function (done) {
       var app = express()
 
       app.use(function (req, res, next) {
@@ -90,16 +91,26 @@ describe('res', function () {
       })
 
       app.use(function (req, res) {
-        res.append('Set-Cookie', 'bar=baz')
+        res.append('Set-Cookie', 'fizz=buzz')
         res.end()
       })
 
       request(app)
-      .get('/')
-      .expect(function (res) {
-        should(res.headers['set-cookie']).eql(['foo=bar; Path=/', 'bar=baz'])
-      })
-      .expect(200, done)
+        .get('/')
+        .expect(200)
+        .expect(shouldHaveHeaderValues('Set-Cookie', ['foo=bar; Path=/', 'fizz=buzz']))
+        .end(done)
     })
   })
 })
+
+function shouldHaveHeaderValues (key, values) {
+  return function (res) {
+    var headers = res.headers[key.toLowerCase()]
+    assert.ok(headers, 'should have header "' + key + '"')
+    assert.strictEqual(headers.length, values.length, 'should have ' + values.length + ' occurances of "' + key + '"')
+    for (var i = 0; i < values.length; i++) {
+      assert.strictEqual(headers[i], values[i])
+    }
+  }
+}

From bc5ca055094bb48dedbb4a4c828dbe5b2d450616 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 21 Feb 2022 19:54:52 -0500
Subject: [PATCH 302/479] tests: remove usage of should

---
 package.json         |  1 -
 test/Route.js        | 34 +++++++++++++++++-----------------
 test/exports.js      | 21 ++++++++++-----------
 test/mocha.opts      |  2 --
 test/res.sendFile.js | 23 ++++++++++-------------
 test/utils.js        | 12 +++++++++---
 6 files changed, 46 insertions(+), 47 deletions(-)
 delete mode 100644 test/mocha.opts

diff --git a/package.json b/package.json
index 2fb6ebaab0b..61e91899e6d 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,6 @@
     "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
     "resolve-path": "1.4.0",
-    "should": "13.2.3",
     "supertest": "6.2.2",
     "vhost": "~3.0.2"
   },
diff --git a/test/Route.js b/test/Route.js
index 005b4634e9a..8e7ddbdbcc1 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -1,7 +1,7 @@
 'use strict'
 
 var after = require('after');
-var should = require('should');
+var assert = require('assert')
 var express = require('../')
   , Route = express.Route
   , methods = require('methods')
@@ -25,7 +25,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.ok()
+        assert.ok(req.called)
         done();
       });
     })
@@ -35,7 +35,7 @@ describe('Route', function(){
       var route = new Route('/foo');
       var cb = after(methods.length, function (err) {
         if (err) return done(err);
-        count.should.equal(methods.length);
+        assert.strictEqual(count, methods.length)
         done();
       });
 
@@ -66,7 +66,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        req.count.should.equal(2);
+        assert.strictEqual(req.count, 2)
         done();
       });
     })
@@ -84,7 +84,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.ok()
+        assert.ok(req.called)
         done();
       });
     })
@@ -104,7 +104,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.true()
+        assert.ok(req.called)
         done();
       });
     })
@@ -130,7 +130,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        req.order.should.equal('abc');
+        assert.strictEqual(req.order, 'abc')
         done();
       });
     })
@@ -156,9 +156,9 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function (err) {
-        should(err).be.ok()
-        should(err.message).equal('foobar');
-        req.order.should.equal('a');
+        assert.ok(err)
+        assert.strictEqual(err.message, 'foobar')
+        assert.strictEqual(req.order, 'a')
         done();
       });
     })
@@ -182,9 +182,9 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function (err) {
-        should(err).be.ok()
-        should(err.message).equal('foobar');
-        req.order.should.equal('a');
+        assert.ok(err)
+        assert.strictEqual(err.message, 'foobar')
+        assert.strictEqual(req.order, 'a')
         done();
       });
     });
@@ -208,7 +208,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.message).equal('oops');
+        assert.strictEqual(req.message, 'oops')
         done();
       });
     });
@@ -222,8 +222,8 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function(err){
-        should(err).be.ok()
-        err.message.should.equal('boom!');
+        assert.ok(err)
+        assert.strictEqual(err.message, 'boom!')
         done();
       });
     });
@@ -234,7 +234,7 @@ describe('Route', function(){
 
       route.all(function(err, req, res, next){
         // this should not execute
-        true.should.be.false()
+        throw new Error('should not be called')
       });
 
       route.dispatch(req, {}, done);
diff --git a/test/exports.js b/test/exports.js
index 98d79365943..5ab0f885ce4 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -3,11 +3,10 @@
 var assert = require('assert')
 var express = require('../');
 var request = require('supertest');
-var should = require('should');
 
 describe('exports', function(){
   it('should expose Router', function(){
-    express.Router.should.be.a.Function()
+    assert.strictEqual(typeof express.Router, 'function')
   })
 
   it('should expose json middleware', function () {
@@ -36,20 +35,23 @@ describe('exports', function(){
   })
 
   it('should expose the application prototype', function(){
-    express.application.set.should.be.a.Function()
+    assert.strictEqual(typeof express.application, 'object')
+    assert.strictEqual(typeof express.application.set, 'function')
   })
 
   it('should expose the request prototype', function(){
-    express.request.accepts.should.be.a.Function()
+    assert.strictEqual(typeof express.request, 'object')
+    assert.strictEqual(typeof express.request.accepts, 'function')
   })
 
   it('should expose the response prototype', function(){
-    express.response.send.should.be.a.Function()
+    assert.strictEqual(typeof express.response, 'object')
+    assert.strictEqual(typeof express.response.send, 'function')
   })
 
   it('should permit modifying the .application prototype', function(){
     express.application.foo = function(){ return 'bar'; };
-    express().foo().should.equal('bar');
+    assert.strictEqual(express().foo(), 'bar')
   })
 
   it('should permit modifying the .request prototype', function(done){
@@ -79,10 +81,7 @@ describe('exports', function(){
   })
 
   it('should throw on old middlewares', function(){
-    var error;
-    try { express.bodyParser; } catch (e) { error = e; }
-    should(error).have.property('message');
-    error.message.should.containEql('middleware');
-    error.message.should.containEql('bodyParser');
+    assert.throws(function () { express.bodyParser() }, /Error:.*middleware.*bodyParser/)
+    assert.throws(function () { express.limit() }, /Error:.*middleware.*limit/)
   })
 })
diff --git a/test/mocha.opts b/test/mocha.opts
deleted file mode 100644
index 1e065ec52d9..00000000000
--- a/test/mocha.opts
+++ /dev/null
@@ -1,2 +0,0 @@
---require should
---slow 20
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index c7fc93a76d3..c676fc41ee9 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -7,7 +7,6 @@ var express = require('../')
   , assert = require('assert');
 var onFinished = require('on-finished');
 var path = require('path');
-var should = require('should');
 var fixtures = path.join(__dirname, 'fixtures');
 var utils = require('./support/utils');
 
@@ -359,15 +358,13 @@ describe('res', function(){
 
       app.use(function (req, res) {
         res.sendFile(path.resolve(fixtures, 'does-not-exist'), function (err) {
-          should(err).be.ok()
-          err.status.should.equal(404);
-          res.send('got it');
+          res.send(err ? 'got ' + err.status + ' error' : 'no error')
         });
       });
 
       request(app)
-      .get('/')
-      .expect(200, 'got it', done);
+        .get('/')
+        .expect(200, 'got 404 error', done)
     })
   })
 
@@ -539,7 +536,7 @@ describe('res', function(){
       app.use(function(req, res){
         res.sendfile('test/fixtures/user.html', function(err){
           assert(!res.headersSent);
-          req.socket.listeners('error').should.have.length(1); // node's original handler
+          assert.strictEqual(req.socket.listeners('error').length, 1) // node's original handler
           done();
         });
 
@@ -783,12 +780,12 @@ describe('res', function(){
         });
 
         request(app)
-        .get('/')
-        .end(function(err, res){
-          res.statusCode.should.equal(404);
-          calls.should.equal(1);
-          done();
-        });
+          .get('/')
+          .expect(404, function (err) {
+            if (err) return done(err)
+            assert.strictEqual(calls, 1)
+            done()
+          })
       })
 
       describe('with non-GET', function(){
diff --git a/test/utils.js b/test/utils.js
index f0cb3c37619..9a38ede6569 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -2,7 +2,6 @@
 
 var assert = require('assert');
 var Buffer = require('safe-buffer').Buffer
-var should = require('should')
 var utils = require('../lib/utils');
 
 describe('utils.etag(body, encoding)', function(){
@@ -91,7 +90,14 @@ describe('utils.isAbsolute()', function(){
 describe('utils.flatten(arr)', function(){
   it('should flatten an array', function(){
     var arr = ['one', ['two', ['three', 'four'], 'five']];
-    should(utils.flatten(arr))
-      .eql(['one', 'two', 'three', 'four', 'five'])
+    var flat = utils.flatten(arr)
+
+    assert.strictEqual(flat.length, 5)
+    assert.strictEqual(flat[0], 'one')
+    assert.strictEqual(flat[1], 'two')
+    assert.strictEqual(flat[2], 'three')
+    assert.strictEqual(flat[3], 'four')
+    assert.strictEqual(flat[4], 'five')
+    assert.ok(flat.every(function (v) { return typeof v === 'string' }))
   })
 })

From 18f782bba97157ab2e0ab754b404388e524915fd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Feb 2022 00:18:36 -0500
Subject: [PATCH 303/479] tests: remove duplicate utils

---
 test/res.download.js | 36 ++++++++++--------------------------
 test/res.redirect.js | 33 +++++++++++++--------------------
 test/res.send.js     | 34 +++++++++-------------------------
 test/res.sendFile.js | 26 ++++++++------------------
 4 files changed, 40 insertions(+), 89 deletions(-)

diff --git a/test/res.download.js b/test/res.download.js
index ce0ee088ba0..29a687a4fd7 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,10 +1,10 @@
 'use strict'
 
 var after = require('after');
-var assert = require('assert');
 var Buffer = require('safe-buffer').Buffer
 var express = require('..');
 var request = require('supertest');
+var utils = require('./support/utils')
 
 describe('res', function(){
   describe('.download(path)', function(){
@@ -129,12 +129,12 @@ describe('res', function(){
       })
 
       request(app)
-      .get('/')
-      .expect(200)
-      .expect('Content-Disposition', 'attachment; filename="document"')
-      .expect('Cache-Control', 'public, max-age=14400')
-      .expect(shouldHaveBody(Buffer.from('tobi')))
-      .end(done)
+        .get('/')
+        .expect(200)
+        .expect('Content-Disposition', 'attachment; filename="document"')
+        .expect('Cache-Control', 'public, max-age=14400')
+        .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+        .end(done)
     })
 
     describe('when options.headers contains Content-Disposition', function () {
@@ -207,25 +207,9 @@ describe('res', function(){
       });
 
       request(app)
-      .get('/')
-      .expect(shouldNotHaveHeader('Content-Disposition'))
-      .expect(200, 'failed', done);
+        .get('/')
+        .expect(utils.shouldNotHaveHeader('Content-Disposition'))
+        .expect(200, 'failed', done)
     })
   })
 })
-
-function shouldHaveBody (buf) {
-  return function (res) {
-    var body = !Buffer.isBuffer(res.body)
-      ? Buffer.from(res.text)
-      : res.body
-    assert.ok(body, 'response has body')
-    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
-  }
-}
-
-function shouldNotHaveHeader(header) {
-  return function (res) {
-    assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
-  };
-}
diff --git a/test/res.redirect.js b/test/res.redirect.js
index be7c773bee0..5ffc7e48f12 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,6 +1,5 @@
 'use strict'
 
-var assert = require('assert')
 var express = require('..');
 var request = require('supertest');
 var utils = require('./support/utils');
@@ -86,11 +85,11 @@ describe('res', function(){
       });
 
       request(app)
-      .head('/')
-      .expect(302)
-      .expect('Location', 'http://google.com')
-      .expect(shouldNotHaveBody())
-      .end(done)
+        .head('/')
+        .expect(302)
+        .expect('Location', 'http://google.com')
+        .expect(utils.shouldNotHaveBody())
+        .end(done)
     })
   })
 
@@ -199,20 +198,14 @@ describe('res', function(){
       });
 
       request(app)
-      .get('/')
-      .set('Accept', 'application/octet-stream')
-      .expect(302)
-      .expect('location', 'http://google.com')
-      .expect('content-length', '0')
-      .expect(utils.shouldNotHaveHeader('Content-Type'))
-      .expect(shouldNotHaveBody())
-      .end(done)
+        .get('/')
+        .set('Accept', 'application/octet-stream')
+        .expect(302)
+        .expect('location', 'http://google.com')
+        .expect('content-length', '0')
+        .expect(utils.shouldNotHaveHeader('Content-Type'))
+        .expect(utils.shouldNotHaveBody())
+        .end(done)
     })
   })
 })
-
-function shouldNotHaveBody () {
-  return function (res) {
-    assert.ok(res.text === '' || res.text === undefined)
-  }
-}
diff --git a/test/res.send.js b/test/res.send.js
index 8f849f8069b..6ba55422882 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -188,11 +188,11 @@ describe('res', function(){
       });
 
       request(app)
-      .get('/')
-      .expect(200)
-      .expect('Content-Type', 'application/octet-stream')
-      .expect(shouldHaveBody(Buffer.from('hello')))
-      .end(done)
+        .get('/')
+        .expect(200)
+        .expect('Content-Type', 'application/octet-stream')
+        .expect(utils.shouldHaveBody(Buffer.from('hello')))
+        .end(done)
     })
 
     it('should set ETag', function (done) {
@@ -259,10 +259,10 @@ describe('res', function(){
       });
 
       request(app)
-      .head('/')
-      .expect(200)
-      .expect(shouldNotHaveBody())
-      .end(done)
+        .head('/')
+        .expect(200)
+        .expect(utils.shouldNotHaveBody())
+        .end(done)
     })
   })
 
@@ -578,19 +578,3 @@ describe('res', function(){
     })
   })
 })
-
-function shouldHaveBody (buf) {
-  return function (res) {
-    var body = !Buffer.isBuffer(res.body)
-      ? Buffer.from(res.text)
-      : res.body
-    assert.ok(body, 'response has body')
-    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
-  }
-}
-
-function shouldNotHaveBody () {
-  return function (res) {
-    assert.ok(res.text === '' || res.text === undefined)
-  }
-}
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index c676fc41ee9..538d6b9d346 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -165,10 +165,10 @@ describe('res', function(){
         var app = createApp(path.resolve(__dirname, 'fixtures/.name'), { dotfiles: 'allow' });
 
         request(app)
-        .get('/')
-        .expect(200)
-        .expect(shouldHaveBody(Buffer.from('tobi')))
-        .end(done)
+          .get('/')
+          .expect(200)
+          .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+          .end(done)
       });
     });
 
@@ -570,10 +570,10 @@ describe('res', function(){
       });
 
       request(app)
-      .get('/')
-      .expect(200)
-      .expect(shouldHaveBody(Buffer.from('tobi')))
-      .end(done)
+        .get('/')
+        .expect(200)
+        .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+        .end(done)
     })
 
     it('should accept headers option', function(done){
@@ -828,13 +828,3 @@ function createApp(path, options, fn) {
 
   return app;
 }
-
-function shouldHaveBody (buf) {
-  return function (res) {
-    var body = !Buffer.isBuffer(res.body)
-      ? Buffer.from(res.text)
-      : res.body
-    assert.ok(body, 'response has body')
-    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
-  }
-}

From 8da8f79c44cefd96f0a194904288658abce13d9d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Feb 2022 00:20:34 -0500
Subject: [PATCH 304/479] tests: fix callback in res.download test

---
 test/res.download.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/res.download.js b/test/res.download.js
index 29a687a4fd7..1322b0a31f9 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -107,7 +107,7 @@ describe('res', function(){
       var options = {}
 
       app.use(function (req, res) {
-        res.download('test/fixtures/user.html', 'document', options, done)
+        res.download('test/fixtures/user.html', 'document', options, cb)
       })
 
       request(app)

From cf9f662655ec8e2b90c5e5d561e0daa083908aa0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Feb 2022 00:17:01 -0500
Subject: [PATCH 305/479] tests: fix position of res.sendfile(path, options)
 test

---
 test/res.sendFile.js | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 538d6b9d346..67981fa127d 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -803,19 +803,19 @@ describe('res', function(){
       })
     })
   })
-})
 
-describe('.sendfile(path, options)', function () {
-  it('should pass options to send module', function (done) {
-    var app = express()
+  describe('.sendfile(path, options)', function () {
+    it('should pass options to send module', function (done) {
+      var app = express()
 
-    app.use(function (req, res) {
-      res.sendfile(path.resolve(fixtures, 'name.txt'), { start: 0, end: 1 })
-    })
+      app.use(function (req, res) {
+        res.sendfile(path.resolve(fixtures, 'name.txt'), { start: 0, end: 1 })
+      })
 
-    request(app)
-      .get('/')
-      .expect(200, 'to', done)
+      request(app)
+        .get('/')
+        .expect(200, 'to', done)
+    })
   })
 })
 

From d0e166c3c6eaf80871b7f38839ea90e048452844 Mon Sep 17 00:00:00 2001
From: apeltop <sunshine@ptokos.com>
Date: Mon, 28 Feb 2022 16:38:06 +0900
Subject: [PATCH 306/479] docs: fix typo in private api jsdoc

closes #4843
---
 lib/response.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index ba02008522d..ccf8d91b2c3 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -1113,7 +1113,7 @@ function sendfile(res, file, options, callback) {
  * ability to escape characters that can trigger HTML sniffing.
  *
  * @param {*} value
- * @param {function} replaces
+ * @param {function} replacer
  * @param {number} spaces
  * @param {boolean} escape
  * @returns {string}

From ea66a9b81bdd95b83d0035d8cbb41e6eacc6ea5b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 28 Feb 2022 21:15:08 -0500
Subject: [PATCH 307/479] docs: update link to github actions ci

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index b60d588c413..61c4d5219db 100644
--- a/Readme.md
+++ b/Readme.md
@@ -147,7 +147,7 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
   [MIT](LICENSE)
 
 [ci-image]: https://img.shields.io/github/workflow/status/expressjs/express/ci/master.svg?label=linux
-[ci-url]: https://github.com/expressjs/express/actions?query=workflow%3Aci
+[ci-url]: https://github.com/expressjs/express/actions/workflows/ci.yml
 [npm-image]: https://img.shields.io/npm/v/express.svg
 [npm-url]: https://npmjs.org/package/express
 [downloads-image]: https://img.shields.io/npm/dm/express.svg

From 4ed35b42026e09bcdcd9da821f172c238fb36cb5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 28 Feb 2022 21:23:49 -0500
Subject: [PATCH 308/479] docs: switch badges to badgen

---
 Readme.md | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/Readme.md b/Readme.md
index 61c4d5219db..51c0fb108e8 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,9 +2,9 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![NPM Version][npm-image]][npm-url]
-  [![NPM Downloads][downloads-image]][downloads-url]
-  [![Linux Build][ci-image]][ci-url]
+  [![NPM Version][npm-version-image]][npm-url]
+  [![NPM Downloads][npm-downloads-image]][npm-downloads-url]
+  [![Linux Build][github-actions-ci-image]][github-actions-ci-url]
   [![Windows Build][appveyor-image]][appveyor-url]
   [![Test Coverage][coveralls-image]][coveralls-url]
 
@@ -146,13 +146,13 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 
   [MIT](LICENSE)
 
-[ci-image]: https://img.shields.io/github/workflow/status/expressjs/express/ci/master.svg?label=linux
-[ci-url]: https://github.com/expressjs/express/actions/workflows/ci.yml
-[npm-image]: https://img.shields.io/npm/v/express.svg
-[npm-url]: https://npmjs.org/package/express
-[downloads-image]: https://img.shields.io/npm/dm/express.svg
-[downloads-url]: https://npmcharts.com/compare/express?minimal=true
-[appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/express/master.svg?label=windows
+[appveyor-image]: https://badgen.net/appveyor/ci/dougwilson/express/master?label=windows
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
-[coveralls-image]: https://img.shields.io/coveralls/expressjs/express/master.svg
+[coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/express/master
 [coveralls-url]: https://coveralls.io/r/expressjs/express?branch=master
+[github-actions-ci-image]: https://badgen.net/github/checks/expressjs/express/master?label=linux
+[github-actions-ci-url]: https://github.com/expressjs/express/actions/workflows/ci.yml
+[npm-downloads-image]: https://badgen.net/npm/dm/express
+[npm-downloads-url]: https://npmcharts.com/compare/express?minimal=true
+[npm-url]: https://npmjs.org/package/express
+[npm-version-image]: https://badgen.net/npm/v/express

From 07aa91f7cbfc3bc2443b292488ab8e3aafb92605 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 28 Feb 2022 21:52:57 -0500
Subject: [PATCH 309/479] docs: consolidate contributing in readme

---
 Readme.md | 47 ++++++++++++++++++++++++++---------------------
 1 file changed, 26 insertions(+), 21 deletions(-)

diff --git a/Readme.md b/Readme.md
index 51c0fb108e8..b0a7950e8a2 100644
--- a/Readme.md
+++ b/Readme.md
@@ -4,9 +4,6 @@
 
   [![NPM Version][npm-version-image]][npm-url]
   [![NPM Downloads][npm-downloads-image]][npm-downloads-url]
-  [![Linux Build][github-actions-ci-image]][github-actions-ci-url]
-  [![Windows Build][appveyor-image]][appveyor-url]
-  [![Test Coverage][coveralls-image]][coveralls-url]
 
 ```js
 const express = require('express')
@@ -33,7 +30,7 @@ the [`npm init` command](https://docs.npmjs.com/creating-a-package-json-file).
 Installation is done using the
 [`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
 
-```bash
+```console
 $ npm install express
 ```
 
@@ -61,35 +58,31 @@ for more information.
 
 **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/expressjs/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/expressjs/express/wiki/New-features-in-4.x).
 
-### Security Issues
-
-If you discover a security vulnerability in Express, please see [Security Policies and Procedures](Security.md).
-
 ## Quick Start
 
   The quickest way to get started with express is to utilize the executable [`express(1)`](https://github.com/expressjs/generator) to generate an application as shown below:
 
   Install the executable. The executable's major version will match Express's:
 
-```bash
+```console
 $ npm install -g express-generator@4
 ```
 
   Create the app:
 
-```bash
+```console
 $ express /tmp/foo && cd /tmp/foo
 ```
 
   Install dependencies:
 
-```bash
+```console
 $ npm install
 ```
 
   Start the server:
 
-```bash
+```console
 $ npm start
 ```
 
@@ -109,7 +102,7 @@ $ npm start
 
   To view the examples, clone the Express repo and install the dependencies:
 
-```bash
+```console
 $ git clone git://github.com/expressjs/express.git --depth 1
 $ cd express
 $ npm install
@@ -117,23 +110,35 @@ $ npm install
 
   Then run whichever example you want:
 
-```bash
+```console
 $ node examples/content-negotiation
 ```
 
-## Tests
+## Contributing
+
+  [![Linux Build][github-actions-ci-image]][github-actions-ci-url]
+  [![Windows Build][appveyor-image]][appveyor-url]
+  [![Test Coverage][coveralls-image]][coveralls-url]
+
+The Express.js project welcomes all constructive contributions. Contributions take many forms,
+from code for bug fixes and enhancements, to additions and fixes to documentation, additional
+tests, triaging incoming pull requests and issues, and more!
+
+See the [Contributing Guide](Contributing.md) for more technical details on contributing.
 
-  To run the test suite, first install the dependencies, then run `npm test`:
+### Security Issues
+
+If you discover a security vulnerability in Express, please see [Security Policies and Procedures](Security.md).
 
-```bash
+### Running Tests
+
+To run the test suite, first install the dependencies, then run `npm test`:
+
+```console
 $ npm install
 $ npm test
 ```
 
-## Contributing
-
-[Contributing Guide](Contributing.md)
-
 ## People
 
 The original author of Express is [TJ Holowaychuk](https://github.com/tj)

From e8594c35715a764afda8e56fd1b60cb2fe147f64 Mon Sep 17 00:00:00 2001
From: Steven <steven@ceriously.com>
Date: Thu, 9 Aug 2018 15:00:29 -0400
Subject: [PATCH 310/479] docs: add install size badge

closes #3710
---
 Readme.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Readme.md b/Readme.md
index b0a7950e8a2..720bf389224 100644
--- a/Readme.md
+++ b/Readme.md
@@ -3,6 +3,7 @@
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
   [![NPM Version][npm-version-image]][npm-url]
+  [![NPM Install Size][npm-install-size-image]][npm-install-size-url]
   [![NPM Downloads][npm-downloads-image]][npm-downloads-url]
 
 ```js
@@ -159,5 +160,7 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 [github-actions-ci-url]: https://github.com/expressjs/express/actions/workflows/ci.yml
 [npm-downloads-image]: https://badgen.net/npm/dm/express
 [npm-downloads-url]: https://npmcharts.com/compare/express?minimal=true
+[npm-install-size-image]: https://badgen.net/packagephobia/install/express
+[npm-install-size-url]: https://packagephobia.com/result?p=express
 [npm-url]: https://npmjs.org/package/express
 [npm-version-image]: https://badgen.net/npm/v/express

From 291993d73c0c92c1ccce2dad264c86bdd1b4fe4b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 1 Mar 2022 00:22:09 -0500
Subject: [PATCH 311/479] tests: expand res.sendFile options tests

---
 test/res.sendFile.js  | 712 ++++++++++++++++++++++++++++++++++--------
 test/support/utils.js |  14 +
 2 files changed, 596 insertions(+), 130 deletions(-)

diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 67981fa127d..e828c17e255 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -28,6 +28,14 @@ describe('res', function(){
       .expect(500, /TypeError: path must be a string to res.sendFile/, done)
     })
 
+    it('should error for non-absolute path', function (done) {
+      var app = createApp('name.txt')
+
+      request(app)
+        .get('/')
+        .expect(500, /TypeError: path must be absolute/, done)
+    })
+
     it('should transfer a file', function (done) {
       var app = createApp(path.resolve(fixtures, 'name.txt'));
 
@@ -90,6 +98,23 @@ describe('res', function(){
       .expect(404, done);
     });
 
+    it('should send cache-control by default', function (done) {
+      var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'))
+
+      request(app)
+        .get('/')
+        .expect('Cache-Control', 'public, max-age=0')
+        .expect(200, done)
+    })
+
+    it('should not serve dotfiles by default', function (done) {
+      var app = createApp(path.resolve(__dirname, 'fixtures/.name'))
+
+      request(app)
+        .get('/')
+        .expect(404, done)
+    })
+
     it('should not override manual content-types', function (done) {
       var app = express();
 
@@ -131,136 +156,6 @@ describe('res', function(){
         server.close(cb)
       })
     })
-
-    describe('with "cacheControl" option', function () {
-      it('should enable cacheControl by default', function (done) {
-        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'))
-
-        request(app)
-        .get('/')
-        .expect('Cache-Control', 'public, max-age=0')
-        .expect(200, done)
-      })
-
-      it('should accept cacheControl option', function (done) {
-        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), { cacheControl: false })
-
-        request(app)
-        .get('/')
-        .expect(utils.shouldNotHaveHeader('Cache-Control'))
-        .expect(200, done)
-      })
-    })
-
-    describe('with "dotfiles" option', function () {
-      it('should not serve dotfiles by default', function (done) {
-        var app = createApp(path.resolve(__dirname, 'fixtures/.name'));
-
-        request(app)
-        .get('/')
-        .expect(404, done);
-      });
-
-      it('should accept dotfiles option', function(done){
-        var app = createApp(path.resolve(__dirname, 'fixtures/.name'), { dotfiles: 'allow' });
-
-        request(app)
-          .get('/')
-          .expect(200)
-          .expect(utils.shouldHaveBody(Buffer.from('tobi')))
-          .end(done)
-      });
-    });
-
-    describe('with "headers" option', function () {
-      it('should accept headers option', function (done) {
-        var headers = {
-          'x-success': 'sent',
-          'x-other': 'done'
-        };
-        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), { headers: headers });
-
-        request(app)
-        .get('/')
-        .expect('x-success', 'sent')
-        .expect('x-other', 'done')
-        .expect(200, done);
-      });
-
-      it('should ignore headers option on 404', function (done) {
-        var headers = { 'x-success': 'sent' };
-        var app = createApp(path.resolve(__dirname, 'fixtures/does-not-exist'), { headers: headers });
-
-        request(app)
-        .get('/')
-        .expect(utils.shouldNotHaveHeader('X-Success'))
-        .expect(404, done);
-      });
-    });
-
-    describe('with "immutable" option', function () {
-      it('should add immutable cache-control directive', function (done) {
-        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
-          immutable: true,
-          maxAge: '4h'
-        })
-
-        request(app)
-        .get('/')
-        .expect('Cache-Control', 'public, max-age=14400, immutable')
-        .expect(200, done)
-      })
-    })
-
-    describe('with "maxAge" option', function () {
-      it('should set cache-control max-age from number', function (done) {
-        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
-          maxAge: 14400000
-        })
-
-        request(app)
-        .get('/')
-        .expect('Cache-Control', 'public, max-age=14400')
-        .expect(200, done)
-      })
-
-      it('should set cache-control max-age from string', function (done) {
-        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
-          maxAge: '4h'
-        })
-
-        request(app)
-        .get('/')
-        .expect('Cache-Control', 'public, max-age=14400')
-        .expect(200, done)
-      })
-    })
-
-    describe('with "root" option', function () {
-      it('should not transfer relative with without', function (done) {
-        var app = createApp('test/fixtures/name.txt');
-
-        request(app)
-        .get('/')
-        .expect(500, /must be absolute/, done);
-      })
-
-      it('should serve relative to "root"', function (done) {
-        var app = createApp('name.txt', {root: fixtures});
-
-        request(app)
-        .get('/')
-        .expect(200, 'tobi', done);
-      })
-
-      it('should disallow requesting out of "root"', function (done) {
-        var app = createApp('foo/../../user.html', {root: fixtures});
-
-        request(app)
-        .get('/')
-        .expect(403, done);
-      })
-    })
   })
 
   describe('.sendFile(path, fn)', function () {
@@ -374,6 +269,563 @@ describe('res', function(){
       .get('/')
       .expect(200, 'to', done)
     })
+
+    describe('with "acceptRanges" option', function () {
+      describe('when true', function () {
+        it('should advertise byte range accepted', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'nums.txt'), {
+              acceptRanges: true
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Accept-Ranges', 'bytes')
+            .expect('123456789')
+            .end(done)
+        })
+
+        it('should respond to range request', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'nums.txt'), {
+              acceptRanges: true
+            })
+          })
+
+          request(app)
+            .get('/')
+            .set('Range', 'bytes=0-4')
+            .expect(206, '12345', done)
+        })
+      })
+
+      describe('when false', function () {
+        it('should not advertise accept-ranges', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'nums.txt'), {
+              acceptRanges: false
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect(utils.shouldNotHaveHeader('Accept-Ranges'))
+            .end(done)
+        })
+
+        it('should not honor range requests', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'nums.txt'), {
+              acceptRanges: false
+            })
+          })
+
+          request(app)
+            .get('/')
+            .set('Range', 'bytes=0-4')
+            .expect(200, '123456789', done)
+        })
+      })
+    })
+
+    describe('with "cacheControl" option', function () {
+      describe('when true', function () {
+        it('should send cache-control header', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              cacheControl: true
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Cache-Control', 'public, max-age=0')
+            .end(done)
+        })
+      })
+
+      describe('when false', function () {
+        it('should not send cache-control header', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              cacheControl: false
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect(utils.shouldNotHaveHeader('Cache-Control'))
+            .end(done)
+        })
+      })
+    })
+
+    describe('with "dotfiles" option', function () {
+      describe('when "allow"', function () {
+        it('should allow dotfiles', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, '.name'), {
+              dotfiles: 'allow'
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+            .end(done)
+        })
+      })
+
+      describe('when "deny"', function () {
+        it('should deny dotfiles', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, '.name'), {
+              dotfiles: 'deny'
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(403)
+            .expect(/Forbidden/)
+            .end(done)
+        })
+      })
+
+      describe('when "ignore"', function () {
+        it('should ignore dotfiles', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, '.name'), {
+              dotfiles: 'ignore'
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(404)
+            .expect(/Not Found/)
+            .end(done)
+        })
+      })
+    })
+
+    describe('with "headers" option', function () {
+      it('should set headers on response', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'user.html'), {
+            headers: {
+              'X-Foo': 'Bar',
+              'X-Bar': 'Foo'
+            }
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('X-Foo', 'Bar')
+          .expect('X-Bar', 'Foo')
+          .end(done)
+      })
+
+      it('should use last header when duplicated', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'user.html'), {
+            headers: {
+              'X-Foo': 'Bar',
+              'x-foo': 'bar'
+            }
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('X-Foo', 'bar')
+          .end(done)
+      })
+
+      it('should override Content-Type', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'user.html'), {
+            headers: {
+              'Content-Type': 'text/x-custom'
+            }
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Content-Type', 'text/x-custom')
+          .end(done)
+      })
+
+      it('should not set headers on 404', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'does-not-exist'), {
+            headers: {
+              'X-Foo': 'Bar'
+            }
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(404)
+          .expect(utils.shouldNotHaveHeader('X-Foo'))
+          .end(done)
+      })
+    })
+
+    describe('with "immutable" option', function () {
+      describe('when true', function () {
+        it('should send cache-control header with immutable', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              immutable: true
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Cache-Control', 'public, max-age=0, immutable')
+            .end(done)
+        })
+      })
+
+      describe('when false', function () {
+        it('should not send cache-control header with immutable', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              immutable: false
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Cache-Control', 'public, max-age=0')
+            .end(done)
+        })
+      })
+    })
+
+    describe('with "lastModified" option', function () {
+      describe('when true', function () {
+        it('should send last-modified header', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              lastModified: true
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect(utils.shouldHaveHeader('Last-Modified'))
+            .end(done)
+        })
+
+        it('should conditionally respond with if-modified-since', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              lastModified: true
+            })
+          })
+
+          request(app)
+            .get('/')
+            .set('If-Modified-Since', (new Date(Date.now() + 99999).toUTCString()))
+            .expect(304, done)
+        })
+      })
+
+      describe('when false', function () {
+        it('should not have last-modified header', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              lastModified: false
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect(utils.shouldNotHaveHeader('Last-Modified'))
+            .end(done)
+        })
+
+        it('should not honor if-modified-since', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              lastModified: false
+            })
+          })
+
+          request(app)
+            .get('/')
+            .set('If-Modified-Since', (new Date(Date.now() + 99999).toUTCString()))
+            .expect(200)
+            .expect(utils.shouldNotHaveHeader('Last-Modified'))
+            .end(done)
+        })
+      })
+    })
+
+    describe('with "maxAge" option', function () {
+      it('should set cache-control max-age to milliseconds', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'user.html'), {
+            maxAge: 20000
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Cache-Control', 'public, max-age=20')
+          .end(done)
+      })
+
+      it('should cap cache-control max-age to 1 year', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'user.html'), {
+            maxAge: 99999999999
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Cache-Control', 'public, max-age=31536000')
+          .end(done)
+      })
+
+      it('should min cache-control max-age to 0', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'user.html'), {
+            maxAge: -20000
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Cache-Control', 'public, max-age=0')
+          .end(done)
+      })
+
+      it('should floor cache-control max-age', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'user.html'), {
+            maxAge: 21911.23
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Cache-Control', 'public, max-age=21')
+          .end(done)
+      })
+
+      describe('when cacheControl: false', function () {
+        it('shold not send cache-control', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              cacheControl: false,
+              maxAge: 20000
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect(utils.shouldNotHaveHeader('Cache-Control'))
+            .end(done)
+        })
+      })
+
+      describe('when string', function () {
+        it('should accept plain number as milliseconds', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              maxAge: '20000'
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Cache-Control', 'public, max-age=20')
+            .end(done)
+        })
+
+        it('should accept suffix "s" for seconds', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              maxAge: '20s'
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Cache-Control', 'public, max-age=20')
+            .end(done)
+        })
+
+        it('should accept suffix "m" for minutes', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              maxAge: '20m'
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Cache-Control', 'public, max-age=1200')
+            .end(done)
+        })
+
+        it('should accept suffix "d" for days', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.sendFile(path.resolve(fixtures, 'user.html'), {
+              maxAge: '20d'
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Cache-Control', 'public, max-age=1728000')
+            .end(done)
+        })
+      })
+    })
+
+    describe('with "root" option', function () {
+      it('should allow relative path', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile('name.txt', {
+            root: fixtures
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200, 'tobi', done)
+      })
+
+      it('should allow up within root', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile('fake/../name.txt', {
+            root: fixtures
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200, 'tobi', done)
+      })
+
+      it('should reject up outside root', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile('..' + path.sep + path.relative(path.dirname(fixtures), path.join(fixtures, 'name.txt')), {
+            root: fixtures
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(403, done)
+      })
+
+      it('should reject reading outside root', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.sendFile('../name.txt', {
+            root: fixtures
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(403, done)
+      })
+    })
   })
 
   describe('.sendfile(path, fn)', function(){
diff --git a/test/support/utils.js b/test/support/utils.js
index 579f042a0c2..5b4062e0b2a 100644
--- a/test/support/utils.js
+++ b/test/support/utils.js
@@ -13,6 +13,7 @@ var Buffer = require('safe-buffer').Buffer
  */
 
 exports.shouldHaveBody = shouldHaveBody
+exports.shouldHaveHeader = shouldHaveHeader
 exports.shouldNotHaveBody = shouldNotHaveBody
 exports.shouldNotHaveHeader = shouldNotHaveHeader;
 
@@ -33,6 +34,19 @@ function shouldHaveBody (buf) {
   }
 }
 
+/**
+ * Assert that a supertest response does have a header.
+ *
+ * @param {string} header Header name to check
+ * @returns {function}
+ */
+
+function shouldHaveHeader (header) {
+  return function (res) {
+    assert.ok((header.toLowerCase() in res.headers), 'should have header ' + header)
+  }
+}
+
 /**
  * Assert that a supertest response does not have a body.
  *

From 446046f886eb457c3d43f57c3f2fc97b698b317a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 1 Mar 2022 00:27:48 -0500
Subject: [PATCH 312/479] build: mocha@9.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 61e91899e6d..79921666294 100644
--- a/package.json
+++ b/package.json
@@ -70,7 +70,7 @@
     "hbs": "4.2.0",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "9.2.0",
+    "mocha": "9.2.1",
     "morgan": "1.10.0",
     "multiparty": "4.2.3",
     "nyc": "15.1.0",

From 490f1a1738449699c217e00ba56db378923fd6b5 Mon Sep 17 00:00:00 2001
From: Tobias Speicher <rootcommander@gmail.com>
Date: Thu, 17 Mar 2022 13:00:48 +0100
Subject: [PATCH 313/479] lint: remove deprecated String.prototype.substr

closes #4860
---
 lib/router/index.js | 16 ++++++++--------
 lib/view.js         |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index fbe94acdb47..467d30458c2 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -108,8 +108,8 @@ proto.param = function param(name, fn) {
   var ret;
 
   if (name[0] === ':') {
-    deprecate('router.param(' + JSON.stringify(name) + ', fn): Use router.param(' + JSON.stringify(name.substr(1)) + ', fn) instead');
-    name = name.substr(1);
+    deprecate('router.param(' + JSON.stringify(name) + ', fn): Use router.param(' + JSON.stringify(name.slice(1)) + ', fn) instead')
+    name = name.slice(1)
   }
 
   for (var i = 0; i < len; ++i) {
@@ -180,14 +180,14 @@ proto.handle = function handle(req, res, out) {
 
     // remove added slash
     if (slashAdded) {
-      req.url = req.url.substr(1);
+      req.url = req.url.slice(1)
       slashAdded = false;
     }
 
     // restore altered req.url
     if (removed.length !== 0) {
       req.baseUrl = parentUrl;
-      req.url = protohost + removed + req.url.substr(protohost.length);
+      req.url = protohost + removed + req.url.slice(protohost.length)
       removed = '';
     }
 
@@ -288,7 +288,7 @@ proto.handle = function handle(req, res, out) {
   function trim_prefix(layer, layerError, layerPath, path) {
     if (layerPath.length !== 0) {
       // Validate path is a prefix match
-      if (layerPath !== path.substr(0, layerPath.length)) {
+      if (layerPath !== path.slice(0, layerPath.length)) {
         next(layerError)
         return
       }
@@ -301,7 +301,7 @@ proto.handle = function handle(req, res, out) {
       // middleware (.use stuff) needs to have the path stripped
       debug('trim prefix (%s) from url %s', layerPath, req.url);
       removed = layerPath;
-      req.url = protohost + req.url.substr(protohost.length + removed.length);
+      req.url = protohost + req.url.slice(protohost.length + removed.length)
 
       // Ensure leading slash
       if (!protohost && req.url[0] !== '/') {
@@ -547,10 +547,10 @@ function getProtohost(url) {
   var pathLength = searchIndex !== -1
     ? searchIndex
     : url.length
-  var fqdnIndex = url.substr(0, pathLength).indexOf('://')
+  var fqdnIndex = url.slice(0, pathLength).indexOf('://')
 
   return fqdnIndex !== -1
-    ? url.substr(0, url.indexOf('/', 3 + fqdnIndex))
+    ? url.substring(0, url.indexOf('/', 3 + fqdnIndex))
     : undefined
 }
 
diff --git a/lib/view.js b/lib/view.js
index cf101caeab9..c08ab4d8d52 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -74,7 +74,7 @@ function View(name, options) {
 
   if (!opts.engines[this.ext]) {
     // load engine
-    var mod = this.ext.substr(1)
+    var mod = this.ext.slice(1)
     debug('require "%s"', mod)
 
     // default engine export

From 2a7417dd84025b62c4207bf018ae8826dc0be629 Mon Sep 17 00:00:00 2001
From: Hashen <37979557+Hashen110@users.noreply.github.com>
Date: Sun, 20 Mar 2022 19:58:13 +0530
Subject: [PATCH 314/479] examples: fixup html

closes #4866
---
 examples/route-separation/views/users/edit.ejs | 2 +-
 examples/search/public/index.html              | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/route-separation/views/users/edit.ejs b/examples/route-separation/views/users/edit.ejs
index 0ca2df7652d..6df78a953a3 100644
--- a/examples/route-separation/views/users/edit.ejs
+++ b/examples/route-separation/views/users/edit.ejs
@@ -3,7 +3,7 @@
 <h1>Editing <%= user.name %></h1>
 
 <div id="user">
-  <form action="?_method=put", method="post">
+  <form action="?_method=put" method="post">
     <p>
       Name:
       <input type="text" value="<%= user.name %>" name="user[name]" />
diff --git a/examples/search/public/index.html b/examples/search/public/index.html
index f67063c502c..7353644ba63 100644
--- a/examples/search/public/index.html
+++ b/examples/search/public/index.html
@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width,initial-scale=1">
   <title>Search example</title>
-  <style type="text/css">
+  <style>
     body {
       font: 14px "Helvetica Neue", Helvetica;
       padding: 50px;
@@ -15,7 +15,7 @@
   <h2>Search</h2>
   <p>Try searching for "ferret" or "cat".</p>
   <input type="search" name="search" value="" />
-  <pre />
+  <pre></pre>
   <script src="/client.js" charset="utf-8"></script>
 </body>
 </html>

From bf4c3ee00f3b95a329fc1dd4dd0cd17c74178121 Mon Sep 17 00:00:00 2001
From: Hashen <37979557+Hashen110@users.noreply.github.com>
Date: Sun, 20 Mar 2022 20:13:23 +0530
Subject: [PATCH 315/479] docs: fix incomplete JSDoc comment

closes #4867
---
 lib/utils.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/utils.js b/lib/utils.js
index 7797b068530..799a6a2b4ee 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -120,6 +120,7 @@ exports.contentDisposition = deprecate.function(contentDisposition,
  * also includes `.originalIndex` for stable sorting
  *
  * @param {String} str
+ * @param {Number} index
  * @return {Object}
  * @api private
  */

From 947b6b7d57939d1a3b33ce008765f9aba3eb6f70 Mon Sep 17 00:00:00 2001
From: Hashen <37979557+Hashen110@users.noreply.github.com>
Date: Sun, 20 Mar 2022 21:08:08 +0530
Subject: [PATCH 316/479] lint: remove unnecessary continue statement in loop

closes #4868
---
 lib/router/index.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index 467d30458c2..791a600f86a 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -251,7 +251,6 @@ proto.handle = function handle(req, res, out) {
       // don't even bother matching route
       if (!has_method && method !== 'HEAD') {
         match = false;
-        continue;
       }
     }
 

From eb4c930d5fb79e55c53b25d6e8a8a5cd15fc5554 Mon Sep 17 00:00:00 2001
From: Kris Kalavantavanich <kkalavantavanich@gmail.com>
Date: Sun, 5 Dec 2021 15:14:40 +0700
Subject: [PATCH 317/479] build: support Node.js 15.x

---
 .github/workflows/ci.yml | 4 ++++
 appveyor.yml             | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d6e1b168ec1..8e60f419c62 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,7 @@ jobs:
         - Node.js 12.x
         - Node.js 13.x
         - Node.js 14.x
+        - Node.js 15.x
 
         include:
         - name: Node.js 0.10
@@ -90,6 +91,9 @@ jobs:
         - name: Node.js 14.x
           node-version: "14.19"
 
+        - name: Node.js 15.x
+          node-version: "15.14"
+
     steps:
     - uses: actions/checkout@v2
 
diff --git a/appveyor.yml b/appveyor.yml
index db54a3fdb04..fc867adee7a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -16,6 +16,7 @@ environment:
     - nodejs_version: "12.22"
     - nodejs_version: "13.14"
     - nodejs_version: "14.19"
+    - nodejs_version: "15.14"
 cache:
   - node_modules
 install:

From 8bf072039100cd264be920f06635fe77f083c751 Mon Sep 17 00:00:00 2001
From: Kris Kalavantavanich <kkalavantavanich@gmail.com>
Date: Sun, 5 Dec 2021 15:15:26 +0700
Subject: [PATCH 318/479] build: support Node.js 16.x

---
 .github/workflows/ci.yml | 4 ++++
 appveyor.yml             | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8e60f419c62..7b153d1b436 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,7 @@ jobs:
         - Node.js 13.x
         - Node.js 14.x
         - Node.js 15.x
+        - Node.js 16.x
 
         include:
         - name: Node.js 0.10
@@ -94,6 +95,9 @@ jobs:
         - name: Node.js 15.x
           node-version: "15.14"
 
+        - name: Node.js 16.x
+          node-version: "16.14"
+
     steps:
     - uses: actions/checkout@v2
 
diff --git a/appveyor.yml b/appveyor.yml
index fc867adee7a..2a2507b411b 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -17,6 +17,7 @@ environment:
     - nodejs_version: "13.14"
     - nodejs_version: "14.19"
     - nodejs_version: "15.14"
+    - nodejs_version: "16.14"
 cache:
   - node_modules
 install:

From 87279c08aa46d178fe6f2e235d2345f17d6b5a37 Mon Sep 17 00:00:00 2001
From: "Tito D. Kesumo Siregar" <tito.siregar@bukalapak.com>
Date: Thu, 20 May 2021 11:23:33 +0700
Subject: [PATCH 319/479] Support proper 205 responses using res.send

closes #4592
closes #4596
---
 History.md       |  5 +++++
 lib/response.js  |  7 +++++++
 test/res.send.js | 16 ++++++++++++++++
 3 files changed, 28 insertions(+)

diff --git a/History.md b/History.md
index 9f3f876512d..fbe01269074 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Support proper 205 responses using `res.send`
+
 4.17.3 / 2022-02-16
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index ccf8d91b2c3..9cf3d52be52 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -213,6 +213,13 @@ res.send = function send(body) {
     chunk = '';
   }
 
+  // alter headers for 205
+  if (this.statusCode === 205) {
+    this.set('Content-Length', '0')
+    this.removeHeader('Transfer-Encoding')
+    chunk = ''
+  }
+
   if (req.method === 'HEAD') {
     // skip body for HEAD
     this.end();
diff --git a/test/res.send.js b/test/res.send.js
index 6ba55422882..c92568db6ad 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -283,6 +283,22 @@ describe('res', function(){
     })
   })
 
+  describe('when .statusCode is 205', function () {
+    it('should strip Transfer-Encoding field and body, set Content-Length', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.status(205).set('Transfer-Encoding', 'chunked').send('foo')
+      })
+
+      request(app)
+        .get('/')
+        .expect(utils.shouldNotHaveHeader('Transfer-Encoding'))
+        .expect('Content-Length', '0')
+        .expect(205, '', done)
+    })
+  })
+
   describe('when .statusCode is 304', function(){
     it('should strip Content-* fields, Transfer-Encoding field, and body', function(done){
       var app = express();

From c17fe058613dc7dfb7779fbe68a9738a108fe408 Mon Sep 17 00:00:00 2001
From: Evan Hahn <me@evanhahn.com>
Date: Wed, 2 Feb 2022 19:13:54 -0600
Subject: [PATCH 320/479] Ignore Object.prototype values in settings through
 app.set/app.get

closes #4802
closes #4803
---
 History.md         |  1 +
 lib/application.js | 19 ++++++++++++++++++-
 test/config.js     | 44 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fbe01269074..97345bb411a 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Support proper 205 responses using `res.send`
 
 4.17.3 / 2022-02-16
diff --git a/lib/application.js b/lib/application.js
index e65ba588959..ebb30b51b3d 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -29,6 +29,13 @@ var flatten = require('array-flatten');
 var merge = require('utils-merge');
 var resolve = require('path').resolve;
 var setPrototypeOf = require('setprototypeof')
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var hasOwnProperty = Object.prototype.hasOwnProperty
 var slice = Array.prototype.slice;
 
 /**
@@ -352,7 +359,17 @@ app.param = function param(name, fn) {
 app.set = function set(setting, val) {
   if (arguments.length === 1) {
     // app.get(setting)
-    return this.settings[setting];
+    var settings = this.settings
+
+    while (settings && settings !== Object.prototype) {
+      if (hasOwnProperty.call(settings, setting)) {
+        return settings[setting]
+      }
+
+      settings = Object.getPrototypeOf(settings)
+    }
+
+    return undefined
   }
 
   debug('set "%s" to %o', setting, val);
diff --git a/test/config.js b/test/config.js
index 8386a4471c3..b04367fdbf8 100644
--- a/test/config.js
+++ b/test/config.js
@@ -11,6 +11,12 @@ describe('config', function () {
       assert.equal(app.get('foo'), 'bar');
     })
 
+    it('should set prototype values', function () {
+      var app = express()
+      app.set('hasOwnProperty', 42)
+      assert.strictEqual(app.get('hasOwnProperty'), 42)
+    })
+
     it('should return the app', function () {
       var app = express();
       assert.equal(app.set('foo', 'bar'), app);
@@ -21,6 +27,17 @@ describe('config', function () {
       assert.equal(app.set('foo', undefined), app);
     })
 
+    it('should return set value', function () {
+      var app = express()
+      app.set('foo', 'bar')
+      assert.strictEqual(app.set('foo'), 'bar')
+    })
+
+    it('should return undefined for prototype values', function () {
+      var app = express()
+      assert.strictEqual(app.set('hasOwnProperty'), undefined)
+    })
+
     describe('"etag"', function(){
       it('should throw on bad value', function(){
         var app = express();
@@ -51,6 +68,11 @@ describe('config', function () {
       assert.strictEqual(app.get('foo'), undefined);
     })
 
+    it('should return undefined for prototype values', function () {
+      var app = express()
+      assert.strictEqual(app.get('hasOwnProperty'), undefined)
+    })
+
     it('should otherwise return the value', function(){
       var app = express();
       app.set('foo', 'bar');
@@ -125,6 +147,12 @@ describe('config', function () {
       assert.equal(app.enable('tobi'), app);
       assert.strictEqual(app.get('tobi'), true);
     })
+
+    it('should set prototype values', function () {
+      var app = express()
+      app.enable('hasOwnProperty')
+      assert.strictEqual(app.get('hasOwnProperty'), true)
+    })
   })
 
   describe('.disable()', function(){
@@ -133,6 +161,12 @@ describe('config', function () {
       assert.equal(app.disable('tobi'), app);
       assert.strictEqual(app.get('tobi'), false);
     })
+
+    it('should set prototype values', function () {
+      var app = express()
+      app.disable('hasOwnProperty')
+      assert.strictEqual(app.get('hasOwnProperty'), false)
+    })
   })
 
   describe('.enabled()', function(){
@@ -146,6 +180,11 @@ describe('config', function () {
       app.set('foo', 'bar');
       assert.strictEqual(app.enabled('foo'), true);
     })
+
+    it('should default to false for prototype values', function () {
+      var app = express()
+      assert.strictEqual(app.enabled('hasOwnProperty'), false)
+    })
   })
 
   describe('.disabled()', function(){
@@ -159,5 +198,10 @@ describe('config', function () {
       app.set('foo', 'bar');
       assert.strictEqual(app.disabled('foo'), false);
     })
+
+    it('should default to true for prototype values', function () {
+      var app = express()
+      assert.strictEqual(app.disabled('hasOwnProperty'), true)
+    })
   })
 })

From 4847d0efa123fae8f12a2c1b88f7e1a87a5f145a Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Sat, 21 Mar 2020 05:04:16 -0400
Subject: [PATCH 321/479] Deprecate string and non-integer arguments to
 res.status

closes #4223
---
 History.md         |   1 +
 lib/response.js    |   3 +
 test/res.status.js | 205 ++++++++++++++++++++++++++++++++++++++++++---
 3 files changed, 197 insertions(+), 12 deletions(-)

diff --git a/History.md b/History.md
index 97345bb411a..2e549136a54 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Deprecate string and non-integer arguments to `res.status`
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Support proper 205 responses using `res.send`
 
diff --git a/lib/response.js b/lib/response.js
index 9cf3d52be52..7a9564d2625 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -64,6 +64,9 @@ var charsetRegExp = /;\s*charset\s*=/;
  */
 
 res.status = function status(code) {
+  if ((typeof code === 'string' || Math.floor(code) !== code) && code > 99 && code < 1000) {
+    deprecate('res.status(' + JSON.stringify(code) + '): use res.status(' + Math.floor(code) + ') instead')
+  }
   this.statusCode = code;
   return this;
 };
diff --git a/test/res.status.js b/test/res.status.js
index e0abc73c4c0..1fe08344eaa 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -1,21 +1,202 @@
 'use strict'
 
 var express = require('../')
-  , request = require('supertest');
+var request = require('supertest')
 
-describe('res', function(){
-  describe('.status(code)', function(){
-    it('should set the response .statusCode', function(done){
-      var app = express();
+var isIoJs = process.release
+  ? process.release.name === 'io.js'
+  : ['v1.', 'v2.', 'v3.'].indexOf(process.version.slice(0, 3)) !== -1
 
-      app.use(function(req, res){
-        res.status(201).end('Created');
-      });
+describe('res', function () {
+  describe('.status(code)', function () {
+    describe('when "code" is undefined', function () {
+      it('should raise error for invalid status code', function (done) {
+        var app = express()
 
-      request(app)
-      .get('/')
-      .expect('Created')
-      .expect(201, done);
+        app.use(function (req, res) {
+          res.status(undefined).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(500, /Invalid status code/, function (err) {
+            if (isIoJs) {
+              done(err ? null : new Error('expected error'))
+            } else {
+              done(err)
+            }
+          })
+      })
+    })
+
+    describe('when "code" is null', function () {
+      it('should raise error for invalid status code', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(null).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(500, /Invalid status code/, function (err) {
+            if (isIoJs) {
+              done(err ? null : new Error('expected error'))
+            } else {
+              done(err)
+            }
+          })
+      })
+    })
+
+    describe('when "code" is 201', function () {
+      it('should set the response status code to 201', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(201).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(201, done)
+      })
+    })
+
+    describe('when "code" is 302', function () {
+      it('should set the response status code to 302', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(302).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(302, done)
+      })
+    })
+
+    describe('when "code" is 403', function () {
+      it('should set the response status code to 403', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(403).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(403, done)
+      })
+    })
+
+    describe('when "code" is 501', function () {
+      it('should set the response status code to 501', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(501).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(501, done)
+      })
+    })
+
+    describe('when "code" is "410"', function () {
+      it('should set the response status code to 410', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status('410').end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(410, done)
+      })
+    })
+
+    describe('when "code" is 410.1', function () {
+      it('should set the response status code to 410', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(410.1).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(410, function (err) {
+            if (isIoJs) {
+              done(err ? null : new Error('expected error'))
+            } else {
+              done(err)
+            }
+          })
+      })
+    })
+
+    describe('when "code" is 1000', function () {
+      it('should raise error for invalid status code', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(1000).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(500, /Invalid status code/, function (err) {
+            if (isIoJs) {
+              done(err ? null : new Error('expected error'))
+            } else {
+              done(err)
+            }
+          })
+      })
+    })
+
+    describe('when "code" is 99', function () {
+      it('should raise error for invalid status code', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(99).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(500, /Invalid status code/, function (err) {
+            if (isIoJs) {
+              done(err ? null : new Error('expected error'))
+            } else {
+              done(err)
+            }
+          })
+      })
+    })
+
+    describe('when "code" is -401', function () {
+      it('should raise error for invalid status code', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(-401).end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(500, /Invalid status code/, function (err) {
+            if (isIoJs) {
+              done(err ? null : new Error('expected error'))
+            } else {
+              done(err)
+            }
+          })
+      })
     })
   })
 })

From 0def9bb659557df1bd659411a1a6f2c5b8b9d893 Mon Sep 17 00:00:00 2001
From: Tommaso Tofacchi <tofacchitommaso@gmail.com>
Date: Fri, 11 Mar 2022 10:02:43 +0100
Subject: [PATCH 322/479] Add "root" option to res.download

fixes #4834
closes #4855
---
 History.md           |  1 +
 lib/response.js      |  4 ++-
 test/res.download.js | 74 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 78 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2e549136a54..d7a2e43c350 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add "root" option to `res.download`
   * Deprecate string and non-integer arguments to `res.status`
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Support proper 205 responses using `res.send`
diff --git a/lib/response.js b/lib/response.js
index 7a9564d2625..101311e0ebf 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -582,7 +582,9 @@ res.download = function download (path, filename, options, callback) {
   opts.headers = headers
 
   // Resolve the full path for sendFile
-  var fullPath = resolve(path);
+  var fullPath = !opts.root
+    ? resolve(path)
+    : path
 
   // send file
   return this.sendFile(fullPath, opts, done)
diff --git a/test/res.download.js b/test/res.download.js
index 1322b0a31f9..51380d4ba16 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -3,9 +3,12 @@
 var after = require('after');
 var Buffer = require('safe-buffer').Buffer
 var express = require('..');
+var path = require('path')
 var request = require('supertest');
 var utils = require('./support/utils')
 
+var FIXTURES_PATH = path.join(__dirname, 'fixtures')
+
 describe('res', function(){
   describe('.download(path)', function(){
     it('should transfer as an attachment', function(done){
@@ -178,6 +181,77 @@ describe('res', function(){
         .end(done)
       })
     })
+
+    describe('with "root" option', function () {
+      it('should allow relative path', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('name.txt', 'document', {
+            root: FIXTURES_PATH
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Content-Disposition', 'attachment; filename="document"')
+          .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+          .end(done)
+      })
+
+      it('should allow up within root', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('fake/../name.txt', 'document', {
+            root: FIXTURES_PATH
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Content-Disposition', 'attachment; filename="document"')
+          .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+          .end(done)
+      })
+
+      it('should reject up outside root', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          var p = '..' + path.sep +
+            path.relative(path.dirname(FIXTURES_PATH), path.join(FIXTURES_PATH, 'name.txt'))
+
+          res.download(p, 'document', {
+            root: FIXTURES_PATH
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(403)
+          .expect(utils.shouldNotHaveHeader('Content-Disposition'))
+          .end(done)
+      })
+
+      it('should reject reading outside root', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('../name.txt', 'document', {
+            root: FIXTURES_PATH
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(403)
+          .expect(utils.shouldNotHaveHeader('Content-Disposition'))
+          .end(done)
+      })
+    })
   })
 
   describe('on failure', function(){

From dd69eedd189eb55658ec435b821df13062cc5a8e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 25 Mar 2022 01:43:45 -0400
Subject: [PATCH 323/479] deps: send@0.18.0

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d7a2e43c350..c5242a99a47 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,14 @@ unreleased
   * Deprecate string and non-integer arguments to `res.status`
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Support proper 205 responses using `res.send`
+  * deps: send@0.18.0
+    - Fix emitted 416 error missing headers property
+    - Limit the headers removed for 304 response
+    - deps: depd@2.0.0
+    - deps: destroy@1.2.0
+    - deps: http-errors@2.0.0
+    - deps: on-finished@2.4.1
+    - deps: statuses@2.0.1
 
 4.17.3 / 2022-02-16
 ===================
diff --git a/package.json b/package.json
index 79921666294..14000074355 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "qs": "6.9.7",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
-    "send": "0.17.2",
+    "send": "0.18.0",
     "serve-static": "1.14.2",
     "setprototypeof": "1.2.0",
     "statuses": "~1.5.0",

From c92420648e18f78d22db24e0ffec99155ec54a49 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 25 Mar 2022 01:44:51 -0400
Subject: [PATCH 324/479] deps: serve-static@1.15.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c5242a99a47..9e4f0d3a8e9 100644
--- a/History.md
+++ b/History.md
@@ -13,6 +13,8 @@ unreleased
     - deps: http-errors@2.0.0
     - deps: on-finished@2.4.1
     - deps: statuses@2.0.1
+  * deps: serve-static@1.15.0
+    - deps: send@0.18.0
 
 4.17.3 / 2022-02-16
 ===================
diff --git a/package.json b/package.json
index 14000074355..c733bb2e507 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
     "send": "0.18.0",
-    "serve-static": "1.14.2",
+    "serve-static": "1.15.0",
     "setprototypeof": "1.2.0",
     "statuses": "~1.5.0",
     "type-is": "~1.6.18",

From f739b162d9cc9fcfc1f514c2441c69f9fcb4364d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 25 Mar 2022 01:46:32 -0400
Subject: [PATCH 325/479] deps: finalhandler@1.2.0

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9e4f0d3a8e9..03b7ba9c7d9 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,10 @@ unreleased
   * Deprecate string and non-integer arguments to `res.status`
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Support proper 205 responses using `res.send`
+  * deps: finalhandler@1.2.0
+    - Remove set content headers that break response
+    - deps: on-finished@2.4.1
+    - deps: statuses@2.0.1
   * deps: send@0.18.0
     - Fix emitted 416 error missing headers property
     - Limit the headers removed for 304 response
diff --git a/package.json b/package.json
index c733bb2e507..6de4bfff428 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "~1.1.2",
+    "finalhandler": "1.2.0",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 03dc3671874b214f67dacaca90f39a1c389f822e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 25 Mar 2022 18:13:42 -0400
Subject: [PATCH 326/479] Allow options without filename in res.download

---
 History.md           |   1 +
 lib/response.js      |   7 ++
 test/res.download.js | 260 ++++++++++++++++++++++++++++++++-----------
 3 files changed, 206 insertions(+), 62 deletions(-)

diff --git a/History.md b/History.md
index 03b7ba9c7d9..9b4bf4bce55 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add "root" option to `res.download`
+  * Allow `options` without `filename` in `res.download`
   * Deprecate string and non-integer arguments to `res.status`
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Support proper 205 responses using `res.send`
diff --git a/lib/response.js b/lib/response.js
index 101311e0ebf..3713e6f9a97 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -561,6 +561,13 @@ res.download = function download (path, filename, options, callback) {
     opts = null
   }
 
+  // support optional filename, where options may be in it's place
+  if (typeof filename === 'object' &&
+    (typeof options === 'function' || options === undefined)) {
+    name = null
+    opts = filename
+  }
+
   // set Content-Disposition when file is sent
   var headers = {
     'Content-Disposition': contentDisposition(name || path)
diff --git a/test/res.download.js b/test/res.download.js
index 51380d4ba16..91b074e8bf6 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -86,46 +86,12 @@ describe('res', function(){
     })
   })
 
-  describe('.download(path, filename, fn)', function(){
-    it('should invoke the callback', function(done){
-      var app = express();
-      var cb = after(2, done);
-
-      app.use(function(req, res){
-        res.download('test/fixtures/user.html', 'document', cb)
-      });
-
-      request(app)
-      .get('/')
-      .expect('Content-Type', 'text/html; charset=UTF-8')
-      .expect('Content-Disposition', 'attachment; filename="document"')
-      .expect(200, cb);
-    })
-  })
-
-  describe('.download(path, filename, options, fn)', function () {
-    it('should invoke the callback', function (done) {
-      var app = express()
-      var cb = after(2, done)
-      var options = {}
-
-      app.use(function (req, res) {
-        res.download('test/fixtures/user.html', 'document', options, cb)
-      })
-
-      request(app)
-      .get('/')
-      .expect(200)
-      .expect('Content-Type', 'text/html; charset=UTF-8')
-      .expect('Content-Disposition', 'attachment; filename="document"')
-      .end(cb)
-    })
-
+  describe('.download(path, options)', function () {
     it('should allow options to res.sendFile()', function (done) {
       var app = express()
 
       app.use(function (req, res) {
-        res.download('test/fixtures/.name', 'document', {
+        res.download('test/fixtures/.name', {
           dotfiles: 'allow',
           maxAge: '4h'
         })
@@ -134,51 +100,124 @@ describe('res', function(){
       request(app)
         .get('/')
         .expect(200)
-        .expect('Content-Disposition', 'attachment; filename="document"')
+        .expect('Content-Disposition', 'attachment; filename=".name"')
         .expect('Cache-Control', 'public, max-age=14400')
         .expect(utils.shouldHaveBody(Buffer.from('tobi')))
         .end(done)
     })
 
-    describe('when options.headers contains Content-Disposition', function () {
-      it('should be ignored', function (done) {
+    describe('with "headers" option', function () {
+      it('should set headers on response', function (done) {
         var app = express()
 
         app.use(function (req, res) {
-          res.download('test/fixtures/user.html', 'document', {
+          res.download('test/fixtures/user.html', {
             headers: {
-              'Content-Type': 'text/x-custom',
-              'Content-Disposition': 'inline'
+              'X-Foo': 'Bar',
+              'X-Bar': 'Foo'
             }
           })
         })
 
         request(app)
-        .get('/')
-        .expect(200)
-        .expect('Content-Type', 'text/x-custom')
-        .expect('Content-Disposition', 'attachment; filename="document"')
-        .end(done)
+          .get('/')
+          .expect(200)
+          .expect('X-Foo', 'Bar')
+          .expect('X-Bar', 'Foo')
+          .end(done)
       })
 
-      it('should be ignored case-insensitively', function (done) {
+      it('should use last header when duplicated', function (done) {
         var app = express()
 
         app.use(function (req, res) {
-          res.download('test/fixtures/user.html', 'document', {
+          res.download('test/fixtures/user.html', {
             headers: {
-              'content-type': 'text/x-custom',
-              'content-disposition': 'inline'
+              'X-Foo': 'Bar',
+              'x-foo': 'bar'
             }
           })
         })
 
         request(app)
-        .get('/')
-        .expect(200)
-        .expect('Content-Type', 'text/x-custom')
-        .expect('Content-Disposition', 'attachment; filename="document"')
-        .end(done)
+          .get('/')
+          .expect(200)
+          .expect('X-Foo', 'bar')
+          .end(done)
+      })
+
+      it('should override Content-Type', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/user.html', {
+            headers: {
+              'Content-Type': 'text/x-custom'
+            }
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Content-Type', 'text/x-custom')
+          .end(done)
+      })
+
+      it('should not set headers on 404', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/does-not-exist', {
+            headers: {
+              'X-Foo': 'Bar'
+            }
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(404)
+          .expect(utils.shouldNotHaveHeader('X-Foo'))
+          .end(done)
+      })
+
+      describe('when headers contains Content-Disposition', function () {
+        it('should be ignored', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.download('test/fixtures/user.html', {
+              headers: {
+                'Content-Disposition': 'inline'
+              }
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Content-Disposition', 'attachment; filename="user.html"')
+            .end(done)
+        })
+
+        it('should be ignored case-insensitively', function (done) {
+          var app = express()
+
+          app.use(function (req, res) {
+            res.download('test/fixtures/user.html', {
+              headers: {
+                'content-disposition': 'inline'
+              }
+            })
+          })
+
+          request(app)
+            .get('/')
+            .expect(200)
+            .expect('Content-Disposition', 'attachment; filename="user.html"')
+            .end(done)
+        })
       })
     })
 
@@ -187,7 +226,7 @@ describe('res', function(){
         var app = express()
 
         app.use(function (req, res) {
-          res.download('name.txt', 'document', {
+          res.download('name.txt', {
             root: FIXTURES_PATH
           })
         })
@@ -195,7 +234,7 @@ describe('res', function(){
         request(app)
           .get('/')
           .expect(200)
-          .expect('Content-Disposition', 'attachment; filename="document"')
+          .expect('Content-Disposition', 'attachment; filename="name.txt"')
           .expect(utils.shouldHaveBody(Buffer.from('tobi')))
           .end(done)
       })
@@ -204,7 +243,7 @@ describe('res', function(){
         var app = express()
 
         app.use(function (req, res) {
-          res.download('fake/../name.txt', 'document', {
+          res.download('fake/../name.txt', {
             root: FIXTURES_PATH
           })
         })
@@ -212,7 +251,7 @@ describe('res', function(){
         request(app)
           .get('/')
           .expect(200)
-          .expect('Content-Disposition', 'attachment; filename="document"')
+          .expect('Content-Disposition', 'attachment; filename="name.txt"')
           .expect(utils.shouldHaveBody(Buffer.from('tobi')))
           .end(done)
       })
@@ -224,7 +263,7 @@ describe('res', function(){
           var p = '..' + path.sep +
             path.relative(path.dirname(FIXTURES_PATH), path.join(FIXTURES_PATH, 'name.txt'))
 
-          res.download(p, 'document', {
+          res.download(p, {
             root: FIXTURES_PATH
           })
         })
@@ -240,7 +279,7 @@ describe('res', function(){
         var app = express()
 
         app.use(function (req, res) {
-          res.download('../name.txt', 'document', {
+          res.download('../name.txt', {
             root: FIXTURES_PATH
           })
         })
@@ -254,6 +293,103 @@ describe('res', function(){
     })
   })
 
+  describe('.download(path, filename, fn)', function(){
+    it('should invoke the callback', function(done){
+      var app = express();
+      var cb = after(2, done);
+
+      app.use(function(req, res){
+        res.download('test/fixtures/user.html', 'document', cb)
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'text/html; charset=UTF-8')
+      .expect('Content-Disposition', 'attachment; filename="document"')
+      .expect(200, cb);
+    })
+  })
+
+  describe('.download(path, filename, options, fn)', function () {
+    it('should invoke the callback', function (done) {
+      var app = express()
+      var cb = after(2, done)
+      var options = {}
+
+      app.use(function (req, res) {
+        res.download('test/fixtures/user.html', 'document', options, cb)
+      })
+
+      request(app)
+      .get('/')
+      .expect(200)
+      .expect('Content-Type', 'text/html; charset=UTF-8')
+      .expect('Content-Disposition', 'attachment; filename="document"')
+      .end(cb)
+    })
+
+    it('should allow options to res.sendFile()', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.download('test/fixtures/.name', 'document', {
+          dotfiles: 'allow',
+          maxAge: '4h'
+        })
+      })
+
+      request(app)
+        .get('/')
+        .expect(200)
+        .expect('Content-Disposition', 'attachment; filename="document"')
+        .expect('Cache-Control', 'public, max-age=14400')
+        .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+        .end(done)
+    })
+
+    describe('when options.headers contains Content-Disposition', function () {
+      it('should be ignored', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/user.html', 'document', {
+            headers: {
+              'Content-Type': 'text/x-custom',
+              'Content-Disposition': 'inline'
+            }
+          })
+        })
+
+        request(app)
+        .get('/')
+        .expect(200)
+        .expect('Content-Type', 'text/x-custom')
+        .expect('Content-Disposition', 'attachment; filename="document"')
+        .end(done)
+      })
+
+      it('should be ignored case-insensitively', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/user.html', 'document', {
+            headers: {
+              'content-type': 'text/x-custom',
+              'content-disposition': 'inline'
+            }
+          })
+        })
+
+        request(app)
+        .get('/')
+        .expect(200)
+        .expect('Content-Type', 'text/x-custom')
+        .expect('Content-Disposition', 'attachment; filename="document"')
+        .end(done)
+      })
+    })
+  })
+
   describe('on failure', function(){
     it('should invoke the callback', function(done){
       var app = express();

From 10b9b507b7d113d04965cccd8d170ee524e3d555 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 25 Mar 2022 18:14:27 -0400
Subject: [PATCH 327/479] examples: use updated res.download in example

---
 examples/downloads/index.js | 5 +----
 package.json                | 1 -
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/examples/downloads/index.js b/examples/downloads/index.js
index 62e7fa6e3eb..6b67e0c8862 100644
--- a/examples/downloads/index.js
+++ b/examples/downloads/index.js
@@ -6,7 +6,6 @@
 
 var express = require('../../');
 var path = require('path');
-var resolvePath = require('resolve-path')
 
 var app = module.exports = express();
 
@@ -25,9 +24,7 @@ app.get('/', function(req, res){
 // /files/* is accessed via req.params[0]
 // but here we name it :file
 app.get('/files/:file(*)', function(req, res, next){
-  var filePath = resolvePath(FILES_DIR, req.params.file)
-
-  res.download(filePath, function (err) {
+  res.download(req.params.file, { root: FILES_DIR }, function (err) {
     if (!err) return; // file sent
     if (err.status !== 404) return next(err); // non-404 error
     // file for download not found
diff --git a/package.json b/package.json
index 6de4bfff428..8f8959a4c33 100644
--- a/package.json
+++ b/package.json
@@ -75,7 +75,6 @@
     "multiparty": "4.2.3",
     "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
-    "resolve-path": "1.4.0",
     "supertest": "6.2.2",
     "vhost": "~3.0.2"
   },

From 9482b82d0b9c498140561087d68f0409078a86ea Mon Sep 17 00:00:00 2001
From: Nadav Ivgi <nadav@shesek.info>
Date: Tue, 13 Mar 2018 08:14:06 +0200
Subject: [PATCH 328/479] Invoke default with same arguments as types in
 res.format

closes #3587
---
 History.md         |  1 +
 lib/response.js    |  9 ++++-----
 test/res.format.js | 29 ++++++++++++++++++++++++++++-
 3 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index 9b4bf4bce55..d1aa9b3b88d 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Allow `options` without `filename` in `res.download`
   * Deprecate string and non-integer arguments to `res.status`
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
+  * Invoke `default` with same arguments as types in `res.format`
   * Support proper 205 responses using `res.send`
   * deps: finalhandler@1.2.0
     - Remove set content headers that break response
diff --git a/lib/response.js b/lib/response.js
index 3713e6f9a97..bfa7871434f 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -684,9 +684,8 @@ res.format = function(obj){
   var req = this.req;
   var next = req.next;
 
-  var fn = obj.default;
-  if (fn) delete obj.default;
-  var keys = Object.keys(obj);
+  var keys = Object.keys(obj)
+    .filter(function (v) { return v !== 'default' })
 
   var key = keys.length > 0
     ? req.accepts(keys)
@@ -697,8 +696,8 @@ res.format = function(obj){
   if (key) {
     this.set('Content-Type', normalizeType(key).value);
     obj[key](req, this, next);
-  } else if (fn) {
-    fn();
+  } else if (obj.default) {
+    obj.default(req, this, next)
   } else {
     var err = new Error('Not Acceptable');
     err.status = err.statusCode = 406;
diff --git a/test/res.format.js b/test/res.format.js
index 24e18d95528..45243d17a1b 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -50,7 +50,12 @@ var app3 = express();
 app3.use(function(req, res, next){
   res.format({
     text: function(){ res.send('hey') },
-    default: function(){ res.send('default') }
+    default: function (a, b, c) {
+      assert(req === a)
+      assert(res === b)
+      assert(next === c)
+      res.send('default')
+    }
   })
 });
 
@@ -118,6 +123,28 @@ describe('res', function(){
         .set('Accept', '*/*')
         .expect('hey', done);
       })
+
+      it('should be able to invoke other formatter', function (done) {
+        var app = express()
+
+        app.use(function (req, res, next) {
+          res.format({
+            json: function () { res.send('json') },
+            default: function () {
+              res.header('x-default', '1')
+              this.json()
+            }
+          })
+        })
+
+        request(app)
+          .get('/')
+          .set('Accept', 'text/plain')
+          .expect(200)
+          .expect('x-default', '1')
+          .expect('json')
+          .end(done)
+      })
     })
 
     describe('in router', function(){

From 1cc816993832eba829a2f556f7c08e27e6371301 Mon Sep 17 00:00:00 2001
From: Ulises Gascon <ulises.gascon@guidesmiths.com>
Date: Wed, 5 Feb 2020 17:56:51 +0100
Subject: [PATCH 329/479] deps: depd@2.0.0

closes #4174
---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d1aa9b3b88d..0b54e1d27b2 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,9 @@ unreleased
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Invoke `default` with same arguments as types in `res.format`
   * Support proper 205 responses using `res.send`
+  * deps: depd@2.0.0
+    - Replace internal `eval` usage with `Function` constructor
+    - Use instance methods on `process` to check for listeners
   * deps: finalhandler@1.2.0
     - Remove set content headers that break response
     - deps: on-finished@2.4.1
diff --git a/package.json b/package.json
index 8f8959a4c33..d9fbe976986 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "cookie": "0.4.2",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
-    "depd": "~1.1.2",
+    "depd": "2.0.0",
     "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",

From 5855339455a7f60774bef4166829e742a5056fa8 Mon Sep 17 00:00:00 2001
From: Chris Barth <chrisjbarth@hotmail.com>
Date: Thu, 18 Apr 2019 09:12:33 -0400
Subject: [PATCH 330/479] Fix behavior of null/undefined as "maxAge" in
 res.cookie

fixes #3935
closes #3936
---
 History.md         |  1 +
 lib/response.js    | 10 +++++++---
 test/res.cookie.js | 30 ++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 0b54e1d27b2..8d9d39b2b80 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Add "root" option to `res.download`
   * Allow `options` without `filename` in `res.download`
   * Deprecate string and non-integer arguments to `res.status`
+  * Fix behavior of `null`/`undefined` as `maxAge` in `res.cookie`
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Invoke `default` with same arguments as types in `res.format`
   * Support proper 205 responses using `res.send`
diff --git a/lib/response.js b/lib/response.js
index bfa7871434f..eeeee1c806b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -868,9 +868,13 @@ res.cookie = function (name, value, options) {
     val = 's:' + sign(val, secret);
   }
 
-  if ('maxAge' in opts) {
-    opts.expires = new Date(Date.now() + opts.maxAge);
-    opts.maxAge /= 1000;
+  if (opts.maxAge != null) {
+    var maxAge = opts.maxAge - 0
+
+    if (!isNaN(maxAge)) {
+      opts.expires = new Date(Date.now() + maxAge)
+      opts.maxAge = Math.floor(maxAge / 1000)
+    }
   }
 
   if (opts.path == null) {
diff --git a/test/res.cookie.js b/test/res.cookie.js
index d10e48646b6..e3a921301f4 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -111,6 +111,36 @@ describe('res', function(){
         .expect(200, optionsCopy, done)
       })
 
+      it('should not throw on null', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { maxAge: null })
+          res.end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Set-Cookie', 'name=tobi; Path=/')
+          .end(done)
+      })
+
+      it('should not throw on undefined', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { maxAge: undefined })
+          res.end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Set-Cookie', 'name=tobi; Path=/')
+          .end(done)
+      })
+
       it('should throw an error with invalid maxAge', function (done) {
         var app = express()
 

From a10770286e7420c5a56ed3cc0b6add2c028ae56e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Mar 2022 23:41:31 -0400
Subject: [PATCH 331/479] Use http-errors for res.format error

---
 History.md      | 1 +
 lib/response.js | 8 ++++----
 package.json    | 1 +
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 8d9d39b2b80..2e542333d91 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,7 @@ unreleased
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Invoke `default` with same arguments as types in `res.format`
   * Support proper 205 responses using `res.send`
+  * Use `http-errors` for `res.format` error
   * deps: depd@2.0.0
     - Replace internal `eval` usage with `Function` constructor
     - Use instance methods on `process` to check for listeners
diff --git a/lib/response.js b/lib/response.js
index eeeee1c806b..d9b8db1c201 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -14,6 +14,7 @@
 
 var Buffer = require('safe-buffer').Buffer
 var contentDisposition = require('content-disposition');
+var createError = require('http-errors')
 var deprecate = require('depd')('express');
 var encodeUrl = require('encodeurl');
 var escapeHtml = require('escape-html');
@@ -699,10 +700,9 @@ res.format = function(obj){
   } else if (obj.default) {
     obj.default(req, this, next)
   } else {
-    var err = new Error('Not Acceptable');
-    err.status = err.statusCode = 406;
-    err.types = normalizeTypes(keys).map(function(o){ return o.value });
-    next(err);
+    next(createError(406, {
+      types: normalizeTypes(keys).map(function (o) { return o.value })
+    }))
   }
 
   return this;
diff --git a/package.json b/package.json
index d9fbe976986..71c110e5f23 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
     "etag": "~1.8.1",
     "finalhandler": "1.2.0",
     "fresh": "0.5.2",
+    "http-errors": "2.0.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",

From 32c558d414b4ac0f5bd70fa6a0f39a5558a7b016 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 2 Apr 2022 21:51:31 -0400
Subject: [PATCH 332/479] deps: body-parser@1.20.0

---
 History.md                 |  10 ++
 package.json               |   2 +-
 test/express.json.js       | 339 +++++++++++++++++++++++++------------
 test/express.raw.js        | 203 ++++++++++++++++++++--
 test/express.text.js       | 221 ++++++++++++++++++++----
 test/express.urlencoded.js | 263 ++++++++++++++++++++--------
 6 files changed, 817 insertions(+), 221 deletions(-)

diff --git a/History.md b/History.md
index 2e542333d91..cba82afcbd2 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,16 @@ unreleased
   * Invoke `default` with same arguments as types in `res.format`
   * Support proper 205 responses using `res.send`
   * Use `http-errors` for `res.format` error
+  * deps: body-parser@1.20.0
+    - Fix error message for json parse whitespace in `strict`
+    - Fix internal error when inflated body exceeds limit
+    - Prevent loss of async hooks context
+    - Prevent hanging when request already read
+    - deps: depd@2.0.0
+    - deps: http-errors@2.0.0
+    - deps: on-finished@2.4.1
+    - deps: qs@6.10.3
+    - deps: raw-body@2.5.1
   * deps: depd@2.0.0
     - Replace internal `eval` usage with `Function` constructor
     - Use instance methods on `process` to check for listeners
diff --git a/package.json b/package.json
index 71c110e5f23..ce6604bd7dd 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
   "dependencies": {
     "accepts": "~1.3.8",
     "array-flatten": "1.1.1",
-    "body-parser": "1.19.2",
+    "body-parser": "1.20.0",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
     "cookie": "0.4.2",
diff --git a/test/express.json.js b/test/express.json.js
index 53a39565a9b..a8cfebc41e2 100644
--- a/test/express.json.js
+++ b/test/express.json.js
@@ -1,10 +1,15 @@
 'use strict'
 
 var assert = require('assert')
+var asyncHooks = tryRequire('async_hooks')
 var Buffer = require('safe-buffer').Buffer
 var express = require('..')
 var request = require('supertest')
 
+var describeAsyncHooks = typeof asyncHooks.AsyncLocalStorage === 'function'
+  ? describe
+  : describe.skip
+
 describe('express.json()', function () {
   it('should parse JSON', function (done) {
     request(createApp())
@@ -38,6 +43,14 @@ describe('express.json()', function () {
       .expect(200, '{}', done)
   })
 
+  it('should 400 when only whitespace', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .send('  \n')
+      .expect(400, '[entity.parse.failed] ' + parseError(' '), done)
+  })
+
   it('should 400 when invalid content-length', function (done) {
     var app = express()
 
@@ -59,6 +72,32 @@ describe('express.json()', function () {
       .expect(400, /content length/, done)
   })
 
+  it('should 500 if stream not readable', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.on('end', next)
+      req.resume()
+    })
+
+    app.use(express.json())
+
+    app.use(function (err, req, res, next) {
+      res.status(err.status || 500)
+      res.send('[' + err.type + '] ' + err.message)
+    })
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .send('{"user":"tobi"}')
+      .expect(500, '[stream.not.readable] stream is not readable', done)
+  })
+
   it('should handle duplicated middleware', function (done) {
     var app = express()
 
@@ -86,7 +125,7 @@ describe('express.json()', function () {
         .post('/')
         .set('Content-Type', 'application/json')
         .send('{:')
-        .expect(400, parseError('{:'), done)
+        .expect(400, '[entity.parse.failed] ' + parseError('{:'), done)
     })
 
     it('should 400 for incomplete', function (done) {
@@ -94,16 +133,7 @@ describe('express.json()', function () {
         .post('/')
         .set('Content-Type', 'application/json')
         .send('{"user"')
-        .expect(400, parseError('{"user"'), done)
-    })
-
-    it('should error with type = "entity.parse.failed"', function (done) {
-      request(this.app)
-        .post('/')
-        .set('Content-Type', 'application/json')
-        .set('X-Error-Property', 'type')
-        .send(' {"user"')
-        .expect(400, 'entity.parse.failed', done)
+        .expect(400, '[entity.parse.failed] ' + parseError('{"user"'), done)
     })
 
     it('should include original body on error object', function (done) {
@@ -124,24 +154,13 @@ describe('express.json()', function () {
         .set('Content-Type', 'application/json')
         .set('Content-Length', '1034')
         .send(JSON.stringify({ str: buf.toString() }))
-        .expect(413, done)
-    })
-
-    it('should error with type = "entity.too.large"', function (done) {
-      var buf = Buffer.alloc(1024, '.')
-      request(createApp({ limit: '1kb' }))
-        .post('/')
-        .set('Content-Type', 'application/json')
-        .set('Content-Length', '1034')
-        .set('X-Error-Property', 'type')
-        .send(JSON.stringify({ str: buf.toString() }))
-        .expect(413, 'entity.too.large', done)
+        .expect(413, '[entity.too.large] request entity too large', done)
     })
 
     it('should 413 when over limit with chunked encoding', function (done) {
+      var app = createApp({ limit: '1kb' })
       var buf = Buffer.alloc(1024, '.')
-      var server = createApp({ limit: '1kb' })
-      var test = request(server).post('/')
+      var test = request(app).post('/')
       test.set('Content-Type', 'application/json')
       test.set('Transfer-Encoding', 'chunked')
       test.write('{"str":')
@@ -149,6 +168,15 @@ describe('express.json()', function () {
       test.expect(413, done)
     })
 
+    it('should 413 when inflated body over limit', function (done) {
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000aab562a2e2952b252d21b05a360148c58a0540b0066f7ce1e0a040000', 'hex'))
+      test.expect(413, done)
+    })
+
     it('should accept number of bytes', function (done) {
       var buf = Buffer.alloc(1024, '.')
       request(createApp({ limit: 1024 }))
@@ -161,11 +189,11 @@ describe('express.json()', function () {
     it('should not change when options altered', function (done) {
       var buf = Buffer.alloc(1024, '.')
       var options = { limit: '1kb' }
-      var server = createApp(options)
+      var app = createApp(options)
 
       options.limit = '100kb'
 
-      request(server)
+      request(app)
         .post('/')
         .set('Content-Type', 'application/json')
         .send(JSON.stringify({ str: buf.toString() }))
@@ -174,14 +202,23 @@ describe('express.json()', function () {
 
     it('should not hang response', function (done) {
       var buf = Buffer.alloc(10240, '.')
-      var server = createApp({ limit: '8kb' })
-      var test = request(server).post('/')
+      var app = createApp({ limit: '8kb' })
+      var test = request(app).post('/')
       test.set('Content-Type', 'application/json')
       test.write(buf)
       test.write(buf)
       test.write(buf)
       test.expect(413, done)
     })
+
+    it('should not error when inflating', function (done) {
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000aab562a2e2952b252d21b05a360148c58a0540b0066f7ce1e0a0400', 'hex'))
+      test.expect(413, done)
+    })
   })
 
   describe('with inflate option', function () {
@@ -195,7 +232,7 @@ describe('express.json()', function () {
         test.set('Content-Encoding', 'gzip')
         test.set('Content-Type', 'application/json')
         test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
-        test.expect(415, 'content encoding unsupported', done)
+        test.expect(415, '[encoding.unsupported] content encoding unsupported', done)
       })
     })
 
@@ -225,7 +262,7 @@ describe('express.json()', function () {
           .post('/')
           .set('Content-Type', 'application/json')
           .send('true')
-          .expect(400, parseError('#rue').replace('#', 't'), done)
+          .expect(400, '[entity.parse.failed] ' + parseError('#rue').replace('#', 't'), done)
       })
     })
 
@@ -253,7 +290,7 @@ describe('express.json()', function () {
           .post('/')
           .set('Content-Type', 'application/json')
           .send('true')
-          .expect(400, parseError('#rue').replace('#', 't'), done)
+          .expect(400, '[entity.parse.failed] ' + parseError('#rue').replace('#', 't'), done)
       })
 
       it('should not parse primitives with leading whitespaces', function (done) {
@@ -261,7 +298,7 @@ describe('express.json()', function () {
           .post('/')
           .set('Content-Type', 'application/json')
           .send('    true')
-          .expect(400, parseError('    #rue').replace('#', 't'), done)
+          .expect(400, '[entity.parse.failed] ' + parseError('    #rue').replace('#', 't'), done)
       })
 
       it('should allow leading whitespaces in JSON', function (done) {
@@ -272,15 +309,6 @@ describe('express.json()', function () {
           .expect(200, '{"user":"tobi"}', done)
       })
 
-      it('should error with type = "entity.parse.failed"', function (done) {
-        request(this.app)
-          .post('/')
-          .set('Content-Type', 'application/json')
-          .set('X-Error-Property', 'type')
-          .send('true')
-          .expect(400, 'entity.parse.failed', done)
-      })
-
       it('should include correct message in stack trace', function (done) {
         request(this.app)
           .post('/')
@@ -397,65 +425,59 @@ describe('express.json()', function () {
     })
 
     it('should error from verify', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x5b) throw new Error('no arrays')
-      } })
-
-      request(app)
-        .post('/')
-        .set('Content-Type', 'application/json')
-        .send('["tobi"]')
-        .expect(403, 'no arrays', done)
-    })
-
-    it('should error with type = "entity.verify.failed"', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x5b) throw new Error('no arrays')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x5b) throw new Error('no arrays')
+        }
+      })
 
       request(app)
         .post('/')
         .set('Content-Type', 'application/json')
-        .set('X-Error-Property', 'type')
         .send('["tobi"]')
-        .expect(403, 'entity.verify.failed', done)
+        .expect(403, '[entity.verify.failed] no arrays', done)
     })
 
     it('should allow custom codes', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] !== 0x5b) return
-        var err = new Error('no arrays')
-        err.status = 400
-        throw err
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] !== 0x5b) return
+          var err = new Error('no arrays')
+          err.status = 400
+          throw err
+        }
+      })
 
       request(app)
         .post('/')
         .set('Content-Type', 'application/json')
         .send('["tobi"]')
-        .expect(400, 'no arrays', done)
+        .expect(400, '[entity.verify.failed] no arrays', done)
     })
 
     it('should allow custom type', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] !== 0x5b) return
-        var err = new Error('no arrays')
-        err.type = 'foo.bar'
-        throw err
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] !== 0x5b) return
+          var err = new Error('no arrays')
+          err.type = 'foo.bar'
+          throw err
+        }
+      })
 
       request(app)
         .post('/')
         .set('Content-Type', 'application/json')
-        .set('X-Error-Property', 'type')
         .send('["tobi"]')
-        .expect(403, 'foo.bar', done)
+        .expect(403, '[foo.bar] no arrays', done)
     })
 
     it('should include original body on error object', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x5b) throw new Error('no arrays')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x5b) throw new Error('no arrays')
+        }
+      })
 
       request(app)
         .post('/')
@@ -466,9 +488,11 @@ describe('express.json()', function () {
     })
 
     it('should allow pass-through', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x5b) throw new Error('no arrays')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x5b) throw new Error('no arrays')
+        }
+      })
 
       request(app)
         .post('/')
@@ -478,9 +502,11 @@ describe('express.json()', function () {
     })
 
     it('should work with different charsets', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x5b) throw new Error('no arrays')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x5b) throw new Error('no arrays')
+        }
+      })
 
       var test = request(app).post('/')
       test.set('Content-Type', 'application/json; charset=utf-16')
@@ -489,14 +515,120 @@ describe('express.json()', function () {
     })
 
     it('should 415 on unknown charset prior to verify', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        throw new Error('unexpected verify call')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          throw new Error('unexpected verify call')
+        }
+      })
 
       var test = request(app).post('/')
       test.set('Content-Type', 'application/json; charset=x-bogus')
       test.write(Buffer.from('00000000', 'hex'))
-      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+      test.expect(415, '[charset.unsupported] unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describeAsyncHooks('async local storage', function () {
+    before(function () {
+      var app = express()
+      var store = { foo: 'bar' }
+
+      app.use(function (req, res, next) {
+        req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+        req.asyncLocalStorage.run(store, next)
+      })
+
+      app.use(express.json())
+
+      app.use(function (req, res, next) {
+        var local = req.asyncLocalStorage.getStore()
+
+        if (local) {
+          res.setHeader('x-store-foo', String(local.foo))
+        }
+
+        next()
+      })
+
+      app.use(function (err, req, res, next) {
+        var local = req.asyncLocalStorage.getStore()
+
+        if (local) {
+          res.setHeader('x-store-foo', String(local.foo))
+        }
+
+        res.status(err.status || 500)
+        res.send('[' + err.type + '] ' + err.message)
+      })
+
+      app.post('/', function (req, res) {
+        res.json(req.body)
+      })
+
+      this.app = app
+    })
+
+    it('should presist store', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{"user":"tobi"}')
+        .expect(200)
+        .expect('x-store-foo', 'bar')
+        .expect('{"user":"tobi"}')
+        .end(done)
+    })
+
+    it('should presist store when unmatched content-type', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/fizzbuzz')
+        .send('buzz')
+        .expect(200)
+        .expect('x-store-foo', 'bar')
+        .expect('{}')
+        .end(done)
+    })
+
+    it('should presist store when inflated', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+      test.expect(200)
+      test.expect('x-store-foo', 'bar')
+      test.expect('{"name":"论"}')
+      test.end(done)
+    })
+
+    it('should presist store when inflate error', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bab56cc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+      test.expect(400)
+      test.expect('x-store-foo', 'bar')
+      test.end(done)
+    })
+
+    it('should presist store when parse error', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{"user":')
+        .expect(400)
+        .expect('x-store-foo', 'bar')
+        .end(done)
+    })
+
+    it('should presist store when limit exceeded', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{"user":"' + Buffer.alloc(1024 * 100, '.').toString() + '"}')
+        .expect(413)
+        .expect('x-store-foo', 'bar')
+        .end(done)
     })
   })
 
@@ -538,15 +670,7 @@ describe('express.json()', function () {
       var test = request(this.app).post('/')
       test.set('Content-Type', 'application/json; charset=koi8-r')
       test.write(Buffer.from('7b226e616d65223a22cec5d4227d', 'hex'))
-      test.expect(415, 'unsupported charset "KOI8-R"', done)
-    })
-
-    it('should error with type = "charset.unsupported"', function (done) {
-      var test = request(this.app).post('/')
-      test.set('Content-Type', 'application/json; charset=koi8-r')
-      test.set('X-Error-Property', 'type')
-      test.write(Buffer.from('7b226e616d65223a22cec5d4227d', 'hex'))
-      test.expect(415, 'charset.unsupported', done)
+      test.expect(415, '[charset.unsupported] unsupported charset "KOI8-R"', done)
     })
   })
 
@@ -599,16 +723,7 @@ describe('express.json()', function () {
       test.set('Content-Encoding', 'nulls')
       test.set('Content-Type', 'application/json')
       test.write(Buffer.from('000000000000', 'hex'))
-      test.expect(415, 'unsupported content encoding "nulls"', done)
-    })
-
-    it('should error with type = "encoding.unsupported"', function (done) {
-      var test = request(this.app).post('/')
-      test.set('Content-Encoding', 'nulls')
-      test.set('Content-Type', 'application/json')
-      test.set('X-Error-Property', 'type')
-      test.write(Buffer.from('000000000000', 'hex'))
-      test.expect(415, 'encoding.unsupported', done)
+      test.expect(415, '[encoding.unsupported] unsupported content encoding "nulls"', done)
     })
 
     it('should 400 on malformed encoding', function (done) {
@@ -639,7 +754,9 @@ function createApp (options) {
 
   app.use(function (err, req, res, next) {
     res.status(err.status || 500)
-    res.send(String(err[req.headers['x-error-property'] || 'message']))
+    res.send(String(req.headers['x-error-property']
+      ? err[req.headers['x-error-property']]
+      : ('[' + err.type + '] ' + err.message)))
   })
 
   app.post('/', function (req, res) {
@@ -663,3 +780,11 @@ function shouldContainInBody (str) {
       'expected \'' + res.text + '\' to contain \'' + str + '\'')
   }
 }
+
+function tryRequire (name) {
+  try {
+    return require(name)
+  } catch (e) {
+    return {}
+  }
+}
diff --git a/test/express.raw.js b/test/express.raw.js
index cbd0736e7cb..4aa62bb85bc 100644
--- a/test/express.raw.js
+++ b/test/express.raw.js
@@ -1,10 +1,15 @@
 'use strict'
 
 var assert = require('assert')
+var asyncHooks = tryRequire('async_hooks')
 var Buffer = require('safe-buffer').Buffer
 var express = require('..')
 var request = require('supertest')
 
+var describeAsyncHooks = typeof asyncHooks.AsyncLocalStorage === 'function'
+  ? describe
+  : describe.skip
+
 describe('express.raw()', function () {
   before(function () {
     this.app = createApp()
@@ -60,6 +65,36 @@ describe('express.raw()', function () {
       .expect(200, { buf: '' }, done)
   })
 
+  it('should 500 if stream not readable', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.on('end', next)
+      req.resume()
+    })
+
+    app.use(express.raw())
+
+    app.use(function (err, req, res, next) {
+      res.status(err.status || 500)
+      res.send('[' + err.type + '] ' + err.message)
+    })
+
+    app.post('/', function (req, res) {
+      if (Buffer.isBuffer(req.body)) {
+        res.json({ buf: req.body.toString('hex') })
+      } else {
+        res.json(req.body)
+      }
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .send('the user is tobi')
+      .expect(500, '[stream.not.readable] stream is not readable', done)
+  })
+
   it('should handle duplicated middleware', function (done) {
     var app = express()
 
@@ -102,6 +137,15 @@ describe('express.raw()', function () {
       test.expect(413, done)
     })
 
+    it('should 413 when inflated body over limit', function (done) {
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('1f8b080000000000000ad3d31b05a360148c64000087e5a14704040000', 'hex'))
+      test.expect(413, done)
+    })
+
     it('should accept number of bytes', function (done) {
       var buf = Buffer.alloc(1028, '.')
       var app = createApp({ limit: 1024 })
@@ -134,6 +178,15 @@ describe('express.raw()', function () {
       test.write(buf)
       test.expect(413, done)
     })
+
+    it('should not error when inflating', function (done) {
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('1f8b080000000000000ad3d31b05a360148c64000087e5a147040400', 'hex'))
+      test.expect(413, done)
+    })
   })
 
   describe('with inflate option', function () {
@@ -147,7 +200,7 @@ describe('express.raw()', function () {
         test.set('Content-Encoding', 'gzip')
         test.set('Content-Type', 'application/octet-stream')
         test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
-        test.expect(415, 'content encoding unsupported', done)
+        test.expect(415, '[encoding.unsupported] content encoding unsupported', done)
       })
     })
 
@@ -263,34 +316,40 @@ describe('express.raw()', function () {
     })
 
     it('should error from verify', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x00) throw new Error('no leading null')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x00) throw new Error('no leading null')
+        }
+      })
 
       var test = request(app).post('/')
       test.set('Content-Type', 'application/octet-stream')
       test.write(Buffer.from('000102', 'hex'))
-      test.expect(403, 'no leading null', done)
+      test.expect(403, '[entity.verify.failed] no leading null', done)
     })
 
     it('should allow custom codes', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] !== 0x00) return
-        var err = new Error('no leading null')
-        err.status = 400
-        throw err
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] !== 0x00) return
+          var err = new Error('no leading null')
+          err.status = 400
+          throw err
+        }
+      })
 
       var test = request(app).post('/')
       test.set('Content-Type', 'application/octet-stream')
       test.write(Buffer.from('000102', 'hex'))
-      test.expect(400, 'no leading null', done)
+      test.expect(400, '[entity.verify.failed] no leading null', done)
     })
 
     it('should allow pass-through', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x00) throw new Error('no leading null')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x00) throw new Error('no leading null')
+        }
+      })
 
       var test = request(app).post('/')
       test.set('Content-Type', 'application/octet-stream')
@@ -299,6 +358,104 @@ describe('express.raw()', function () {
     })
   })
 
+  describeAsyncHooks('async local storage', function () {
+    before(function () {
+      var app = express()
+      var store = { foo: 'bar' }
+
+      app.use(function (req, res, next) {
+        req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+        req.asyncLocalStorage.run(store, next)
+      })
+
+      app.use(express.raw())
+
+      app.use(function (req, res, next) {
+        var local = req.asyncLocalStorage.getStore()
+
+        if (local) {
+          res.setHeader('x-store-foo', String(local.foo))
+        }
+
+        next()
+      })
+
+      app.use(function (err, req, res, next) {
+        var local = req.asyncLocalStorage.getStore()
+
+        if (local) {
+          res.setHeader('x-store-foo', String(local.foo))
+        }
+
+        res.status(err.status || 500)
+        res.send('[' + err.type + '] ' + err.message)
+      })
+
+      app.post('/', function (req, res) {
+        if (Buffer.isBuffer(req.body)) {
+          res.json({ buf: req.body.toString('hex') })
+        } else {
+          res.json(req.body)
+        }
+      })
+
+      this.app = app
+    })
+
+    it('should presist store', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/octet-stream')
+        .send('the user is tobi')
+        .expect(200)
+        .expect('x-store-foo', 'bar')
+        .expect({ buf: '746865207573657220697320746f6269' })
+        .end(done)
+    })
+
+    it('should presist store when unmatched content-type', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/fizzbuzz')
+        .send('buzz')
+        .expect(200)
+        .expect('x-store-foo', 'bar')
+        .expect('{}')
+        .end(done)
+    })
+
+    it('should presist store when inflated', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200)
+      test.expect('x-store-foo', 'bar')
+      test.expect({ buf: '6e616d653de8aeba' })
+      test.end(done)
+    })
+
+    it('should presist store when inflate error', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad6080000', 'hex'))
+      test.expect(400)
+      test.expect('x-store-foo', 'bar')
+      test.end(done)
+    })
+
+    it('should presist store when limit exceeded', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/octet-stream')
+        .send('the user is ' + Buffer.alloc(1024 * 100, '.').toString())
+        .expect(413)
+        .expect('x-store-foo', 'bar')
+        .end(done)
+    })
+  })
+
   describe('charset', function () {
     before(function () {
       this.app = createApp()
@@ -356,12 +513,12 @@ describe('express.raw()', function () {
       test.expect(200, { buf: '6e616d653de8aeba' }, done)
     })
 
-    it('should fail on unknown encoding', function (done) {
+    it('should 415 on unknown encoding', function (done) {
       var test = request(this.app).post('/')
       test.set('Content-Encoding', 'nulls')
       test.set('Content-Type', 'application/octet-stream')
       test.write(Buffer.from('000000000000', 'hex'))
-      test.expect(415, 'unsupported content encoding "nulls"', done)
+      test.expect(415, '[encoding.unsupported] unsupported content encoding "nulls"', done)
     })
   })
 })
@@ -373,7 +530,9 @@ function createApp (options) {
 
   app.use(function (err, req, res, next) {
     res.status(err.status || 500)
-    res.send(String(err[req.headers['x-error-property'] || 'message']))
+    res.send(String(req.headers['x-error-property']
+      ? err[req.headers['x-error-property']]
+      : ('[' + err.type + '] ' + err.message)))
   })
 
   app.post('/', function (req, res) {
@@ -386,3 +545,11 @@ function createApp (options) {
 
   return app
 }
+
+function tryRequire (name) {
+  try {
+    return require(name)
+  } catch (e) {
+    return {}
+  }
+}
diff --git a/test/express.text.js b/test/express.text.js
index ebc12cd1098..cb7750a525c 100644
--- a/test/express.text.js
+++ b/test/express.text.js
@@ -1,10 +1,15 @@
 'use strict'
 
 var assert = require('assert')
+var asyncHooks = tryRequire('async_hooks')
 var Buffer = require('safe-buffer').Buffer
 var express = require('..')
 var request = require('supertest')
 
+var describeAsyncHooks = typeof asyncHooks.AsyncLocalStorage === 'function'
+  ? describe
+  : describe.skip
+
 describe('express.text()', function () {
   before(function () {
     this.app = createApp()
@@ -56,6 +61,32 @@ describe('express.text()', function () {
       .expect(200, '""', done)
   })
 
+  it('should 500 if stream not readable', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.on('end', next)
+      req.resume()
+    })
+
+    app.use(express.text())
+
+    app.use(function (err, req, res, next) {
+      res.status(err.status || 500)
+      res.send('[' + err.type + '] ' + err.message)
+    })
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .send('user is tobi')
+      .expect(500, '[stream.not.readable] stream is not readable', done)
+  })
+
   it('should handle duplicated middleware', function (done) {
     var app = express()
 
@@ -75,16 +106,16 @@ describe('express.text()', function () {
 
   describe('with defaultCharset option', function () {
     it('should change default charset', function (done) {
-      var app = createApp({ defaultCharset: 'koi8-r' })
-      var test = request(app).post('/')
+      var server = createApp({ defaultCharset: 'koi8-r' })
+      var test = request(server).post('/')
       test.set('Content-Type', 'text/plain')
       test.write(Buffer.from('6e616d6520697320cec5d4', 'hex'))
       test.expect(200, '"name is нет"', done)
     })
 
     it('should honor content-type charset', function (done) {
-      var app = createApp({ defaultCharset: 'koi8-r' })
-      var test = request(app).post('/')
+      var server = createApp({ defaultCharset: 'koi8-r' })
+      var test = request(server).post('/')
       test.set('Content-Type', 'text/plain; charset=utf-8')
       test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
       test.expect(200, '"name is 论"', done)
@@ -103,8 +134,8 @@ describe('express.text()', function () {
     })
 
     it('should 413 when over limit with chunked encoding', function (done) {
-      var buf = Buffer.alloc(1028, '.')
       var app = createApp({ limit: '1kb' })
+      var buf = Buffer.alloc(1028, '.')
       var test = request(app).post('/')
       test.set('Content-Type', 'text/plain')
       test.set('Transfer-Encoding', 'chunked')
@@ -112,6 +143,15 @@ describe('express.text()', function () {
       test.expect(413, done)
     })
 
+    it('should 413 when inflated body over limit', function (done) {
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('1f8b080000000000000ad3d31b05a360148c64000087e5a14704040000', 'hex'))
+      test.expect(413, done)
+    })
+
     it('should accept number of bytes', function (done) {
       var buf = Buffer.alloc(1028, '.')
       request(createApp({ limit: 1024 }))
@@ -136,8 +176,8 @@ describe('express.text()', function () {
     })
 
     it('should not hang response', function (done) {
-      var buf = Buffer.alloc(10240, '.')
       var app = createApp({ limit: '8kb' })
+      var buf = Buffer.alloc(10240, '.')
       var test = request(app).post('/')
       test.set('Content-Type', 'text/plain')
       test.write(buf)
@@ -145,6 +185,17 @@ describe('express.text()', function () {
       test.write(buf)
       test.expect(413, done)
     })
+
+    it('should not error when inflating', function (done) {
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('1f8b080000000000000ad3d31b05a360148c64000087e5a1470404', 'hex'))
+      setTimeout(function () {
+        test.expect(413, done)
+      }, 100)
+    })
   })
 
   describe('with inflate option', function () {
@@ -158,7 +209,7 @@ describe('express.text()', function () {
         test.set('Content-Encoding', 'gzip')
         test.set('Content-Type', 'text/plain')
         test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
-        test.expect(415, 'content encoding unsupported', done)
+        test.expect(415, '[encoding.unsupported] content encoding unsupported', done)
       })
     })
 
@@ -278,36 +329,42 @@ describe('express.text()', function () {
     })
 
     it('should error from verify', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x20) throw new Error('no leading space')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x20) throw new Error('no leading space')
+        }
+      })
 
       request(app)
         .post('/')
         .set('Content-Type', 'text/plain')
         .send(' user is tobi')
-        .expect(403, 'no leading space', done)
+        .expect(403, '[entity.verify.failed] no leading space', done)
     })
 
     it('should allow custom codes', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] !== 0x20) return
-        var err = new Error('no leading space')
-        err.status = 400
-        throw err
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] !== 0x20) return
+          var err = new Error('no leading space')
+          err.status = 400
+          throw err
+        }
+      })
 
       request(app)
         .post('/')
         .set('Content-Type', 'text/plain')
         .send(' user is tobi')
-        .expect(400, 'no leading space', done)
+        .expect(400, '[entity.verify.failed] no leading space', done)
     })
 
     it('should allow pass-through', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x20) throw new Error('no leading space')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x20) throw new Error('no leading space')
+        }
+      })
 
       request(app)
         .post('/')
@@ -317,14 +374,110 @@ describe('express.text()', function () {
     })
 
     it('should 415 on unknown charset prior to verify', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        throw new Error('unexpected verify call')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          throw new Error('unexpected verify call')
+        }
+      })
 
       var test = request(app).post('/')
       test.set('Content-Type', 'text/plain; charset=x-bogus')
       test.write(Buffer.from('00000000', 'hex'))
-      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+      test.expect(415, '[charset.unsupported] unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describeAsyncHooks('async local storage', function () {
+    before(function () {
+      var app = express()
+      var store = { foo: 'bar' }
+
+      app.use(function (req, res, next) {
+        req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+        req.asyncLocalStorage.run(store, next)
+      })
+
+      app.use(express.text())
+
+      app.use(function (req, res, next) {
+        var local = req.asyncLocalStorage.getStore()
+
+        if (local) {
+          res.setHeader('x-store-foo', String(local.foo))
+        }
+
+        next()
+      })
+
+      app.use(function (err, req, res, next) {
+        var local = req.asyncLocalStorage.getStore()
+
+        if (local) {
+          res.setHeader('x-store-foo', String(local.foo))
+        }
+
+        res.status(err.status || 500)
+        res.send('[' + err.type + '] ' + err.message)
+      })
+
+      app.post('/', function (req, res) {
+        res.json(req.body)
+      })
+
+      this.app = app
+    })
+
+    it('should presist store', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send('user is tobi')
+        .expect(200)
+        .expect('x-store-foo', 'bar')
+        .expect('"user is tobi"')
+        .end(done)
+    })
+
+    it('should presist store when unmatched content-type', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/fizzbuzz')
+        .send('buzz')
+        .expect(200)
+        .expect('x-store-foo', 'bar')
+        .expect('{}')
+        .end(done)
+    })
+
+    it('should presist store when inflated', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+      test.expect(200)
+      test.expect('x-store-foo', 'bar')
+      test.expect('"name is 论"')
+      test.end(done)
+    })
+
+    it('should presist store when inflate error', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b0000', 'hex'))
+      test.expect(400)
+      test.expect('x-store-foo', 'bar')
+      test.end(done)
+    })
+
+    it('should presist store when limit exceeded', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send('user is ' + Buffer.alloc(1024 * 100, '.').toString())
+        .expect(413)
+        .expect('x-store-foo', 'bar')
+        .end(done)
     })
   })
 
@@ -366,7 +519,7 @@ describe('express.text()', function () {
       var test = request(this.app).post('/')
       test.set('Content-Type', 'text/plain; charset=x-bogus')
       test.write(Buffer.from('00000000', 'hex'))
-      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+      test.expect(415, '[charset.unsupported] unsupported charset "X-BOGUS"', done)
     })
   })
 
@@ -414,12 +567,12 @@ describe('express.text()', function () {
       test.expect(200, '"name is 论"', done)
     })
 
-    it('should fail on unknown encoding', function (done) {
+    it('should 415 on unknown encoding', function (done) {
       var test = request(this.app).post('/')
       test.set('Content-Encoding', 'nulls')
       test.set('Content-Type', 'text/plain')
       test.write(Buffer.from('000000000000', 'hex'))
-      test.expect(415, 'unsupported content encoding "nulls"', done)
+      test.expect(415, '[encoding.unsupported] unsupported content encoding "nulls"', done)
     })
   })
 })
@@ -431,7 +584,9 @@ function createApp (options) {
 
   app.use(function (err, req, res, next) {
     res.status(err.status || 500)
-    res.send(err.message)
+    res.send(String(req.headers['x-error-property']
+      ? err[req.headers['x-error-property']]
+      : ('[' + err.type + '] ' + err.message)))
   })
 
   app.post('/', function (req, res) {
@@ -440,3 +595,11 @@ function createApp (options) {
 
   return app
 }
+
+function tryRequire (name) {
+  try {
+    return require(name)
+  } catch (e) {
+    return {}
+  }
+}
diff --git a/test/express.urlencoded.js b/test/express.urlencoded.js
index 340eb74316c..e07432c86c3 100644
--- a/test/express.urlencoded.js
+++ b/test/express.urlencoded.js
@@ -1,10 +1,15 @@
 'use strict'
 
 var assert = require('assert')
+var asyncHooks = tryRequire('async_hooks')
 var Buffer = require('safe-buffer').Buffer
 var express = require('..')
 var request = require('supertest')
 
+var describeAsyncHooks = typeof asyncHooks.AsyncLocalStorage === 'function'
+  ? describe
+  : describe.skip
+
 describe('express.urlencoded()', function () {
   before(function () {
     this.app = createApp()
@@ -57,6 +62,32 @@ describe('express.urlencoded()', function () {
       .expect(200, '{}', done)
   })
 
+  it('should 500 if stream not readable', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.on('end', next)
+      req.resume()
+    })
+
+    app.use(express.urlencoded())
+
+    app.use(function (err, req, res, next) {
+      res.status(err.status || 500)
+      res.send('[' + err.type + '] ' + err.message)
+    })
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('user=tobi')
+      .expect(500, '[stream.not.readable] stream is not readable', done)
+  })
+
   it('should handle duplicated middleware', function (done) {
     var app = express()
 
@@ -217,7 +248,7 @@ describe('express.urlencoded()', function () {
         test.set('Content-Encoding', 'gzip')
         test.set('Content-Type', 'application/x-www-form-urlencoded')
         test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
-        test.expect(415, 'content encoding unsupported', done)
+        test.expect(415, '[encoding.unsupported] content encoding unsupported', done)
       })
     })
 
@@ -248,8 +279,8 @@ describe('express.urlencoded()', function () {
     })
 
     it('should 413 when over limit with chunked encoding', function (done) {
-      var buf = Buffer.alloc(1024, '.')
       var app = createApp({ limit: '1kb' })
+      var buf = Buffer.alloc(1024, '.')
       var test = request(app).post('/')
       test.set('Content-Type', 'application/x-www-form-urlencoded')
       test.set('Transfer-Encoding', 'chunked')
@@ -258,6 +289,15 @@ describe('express.urlencoded()', function () {
       test.expect(413, done)
     })
 
+    it('should 413 when inflated body over limit', function (done) {
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('1f8b080000000000000a2b2e29b2d51b05a360148c580000a0351f9204040000', 'hex'))
+      test.expect(413, done)
+    })
+
     it('should accept number of bytes', function (done) {
       var buf = Buffer.alloc(1024, '.')
       request(createApp({ limit: 1024 }))
@@ -282,8 +322,8 @@ describe('express.urlencoded()', function () {
     })
 
     it('should not hang response', function (done) {
-      var buf = Buffer.alloc(10240, '.')
       var app = createApp({ limit: '8kb' })
+      var buf = Buffer.alloc(10240, '.')
       var test = request(app).post('/')
       test.set('Content-Type', 'application/x-www-form-urlencoded')
       test.write(buf)
@@ -291,6 +331,15 @@ describe('express.urlencoded()', function () {
       test.write(buf)
       test.expect(413, done)
     })
+
+    it('should not error when inflating', function (done) {
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('1f8b080000000000000a2b2e29b2d51b05a360148c580000a0351f92040400', 'hex'))
+      test.expect(413, done)
+    })
   })
 
   describe('with parameterLimit option', function () {
@@ -310,16 +359,7 @@ describe('express.urlencoded()', function () {
           .post('/')
           .set('Content-Type', 'application/x-www-form-urlencoded')
           .send(createManyParams(11))
-          .expect(413, /too many parameters/, done)
-      })
-
-      it('should error with type = "parameters.too.many"', function (done) {
-        request(createApp({ extended: false, parameterLimit: 10 }))
-          .post('/')
-          .set('Content-Type', 'application/x-www-form-urlencoded')
-          .set('X-Error-Property', 'type')
-          .send(createManyParams(11))
-          .expect(413, 'parameters.too.many', done)
+          .expect(413, '[parameters.too.many] too many parameters', done)
       })
 
       it('should work when at the limit', function (done) {
@@ -374,16 +414,7 @@ describe('express.urlencoded()', function () {
           .post('/')
           .set('Content-Type', 'application/x-www-form-urlencoded')
           .send(createManyParams(11))
-          .expect(413, /too many parameters/, done)
-      })
-
-      it('should error with type = "parameters.too.many"', function (done) {
-        request(createApp({ extended: true, parameterLimit: 10 }))
-          .post('/')
-          .set('Content-Type', 'application/x-www-form-urlencoded')
-          .set('X-Error-Property', 'type')
-          .send(createManyParams(11))
-          .expect(413, 'parameters.too.many', done)
+          .expect(413, '[parameters.too.many] too many parameters', done)
       })
 
       it('should work when at the limit', function (done) {
@@ -526,65 +557,59 @@ describe('express.urlencoded()', function () {
     })
 
     it('should error from verify', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x20) throw new Error('no leading space')
-      } })
-
-      request(app)
-        .post('/')
-        .set('Content-Type', 'application/x-www-form-urlencoded')
-        .send(' user=tobi')
-        .expect(403, 'no leading space', done)
-    })
-
-    it('should error with type = "entity.verify.failed"', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x20) throw new Error('no leading space')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x20) throw new Error('no leading space')
+        }
+      })
 
       request(app)
         .post('/')
         .set('Content-Type', 'application/x-www-form-urlencoded')
-        .set('X-Error-Property', 'type')
         .send(' user=tobi')
-        .expect(403, 'entity.verify.failed', done)
+        .expect(403, '[entity.verify.failed] no leading space', done)
     })
 
     it('should allow custom codes', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] !== 0x20) return
-        var err = new Error('no leading space')
-        err.status = 400
-        throw err
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] !== 0x20) return
+          var err = new Error('no leading space')
+          err.status = 400
+          throw err
+        }
+      })
 
       request(app)
         .post('/')
         .set('Content-Type', 'application/x-www-form-urlencoded')
         .send(' user=tobi')
-        .expect(400, 'no leading space', done)
+        .expect(400, '[entity.verify.failed] no leading space', done)
     })
 
     it('should allow custom type', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] !== 0x20) return
-        var err = new Error('no leading space')
-        err.type = 'foo.bar'
-        throw err
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] !== 0x20) return
+          var err = new Error('no leading space')
+          err.type = 'foo.bar'
+          throw err
+        }
+      })
 
       request(app)
         .post('/')
         .set('Content-Type', 'application/x-www-form-urlencoded')
-        .set('X-Error-Property', 'type')
         .send(' user=tobi')
-        .expect(403, 'foo.bar', done)
+        .expect(403, '[foo.bar] no leading space', done)
     })
 
     it('should allow pass-through', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        if (buf[0] === 0x5b) throw new Error('no arrays')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          if (buf[0] === 0x5b) throw new Error('no arrays')
+        }
+      })
 
       request(app)
         .post('/')
@@ -594,14 +619,110 @@ describe('express.urlencoded()', function () {
     })
 
     it('should 415 on unknown charset prior to verify', function (done) {
-      var app = createApp({ verify: function (req, res, buf) {
-        throw new Error('unexpected verify call')
-      } })
+      var app = createApp({
+        verify: function (req, res, buf) {
+          throw new Error('unexpected verify call')
+        }
+      })
 
       var test = request(app).post('/')
       test.set('Content-Type', 'application/x-www-form-urlencoded; charset=x-bogus')
       test.write(Buffer.from('00000000', 'hex'))
-      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+      test.expect(415, '[charset.unsupported] unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describeAsyncHooks('async local storage', function () {
+    before(function () {
+      var app = express()
+      var store = { foo: 'bar' }
+
+      app.use(function (req, res, next) {
+        req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+        req.asyncLocalStorage.run(store, next)
+      })
+
+      app.use(express.urlencoded())
+
+      app.use(function (req, res, next) {
+        var local = req.asyncLocalStorage.getStore()
+
+        if (local) {
+          res.setHeader('x-store-foo', String(local.foo))
+        }
+
+        next()
+      })
+
+      app.use(function (err, req, res, next) {
+        var local = req.asyncLocalStorage.getStore()
+
+        if (local) {
+          res.setHeader('x-store-foo', String(local.foo))
+        }
+
+        res.status(err.status || 500)
+        res.send('[' + err.type + '] ' + err.message)
+      })
+
+      app.post('/', function (req, res) {
+        res.json(req.body)
+      })
+
+      this.app = app
+    })
+
+    it('should presist store', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('user=tobi')
+        .expect(200)
+        .expect('x-store-foo', 'bar')
+        .expect('{"user":"tobi"}')
+        .end(done)
+    })
+
+    it('should presist store when unmatched content-type', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/fizzbuzz')
+        .send('buzz')
+        .expect(200)
+        .expect('x-store-foo', 'bar')
+        .expect('{}')
+        .end(done)
+    })
+
+    it('should presist store when inflated', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200)
+      test.expect('x-store-foo', 'bar')
+      test.expect('{"name":"论"}')
+      test.end(done)
+    })
+
+    it('should presist store when inflate error', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad6080000', 'hex'))
+      test.expect(400)
+      test.expect('x-store-foo', 'bar')
+      test.end(done)
+    })
+
+    it('should presist store when limit exceeded', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('user=' + Buffer.alloc(1024 * 100, '.').toString())
+        .expect(413)
+        .expect('x-store-foo', 'bar')
+        .end(done)
     })
   })
 
@@ -636,7 +757,7 @@ describe('express.urlencoded()', function () {
       var test = request(this.app).post('/')
       test.set('Content-Type', 'application/x-www-form-urlencoded; charset=koi8-r')
       test.write(Buffer.from('6e616d653dcec5d4', 'hex'))
-      test.expect(415, 'unsupported charset "KOI8-R"', done)
+      test.expect(415, '[charset.unsupported] unsupported charset "KOI8-R"', done)
     })
   })
 
@@ -684,12 +805,12 @@ describe('express.urlencoded()', function () {
       test.expect(200, '{"name":"论"}', done)
     })
 
-    it('should fail on unknown encoding', function (done) {
+    it('should 415 on unknown encoding', function (done) {
       var test = request(this.app).post('/')
       test.set('Content-Encoding', 'nulls')
       test.set('Content-Type', 'application/x-www-form-urlencoded')
       test.write(Buffer.from('000000000000', 'hex'))
-      test.expect(415, 'unsupported content encoding "nulls"', done)
+      test.expect(415, '[encoding.unsupported] unsupported content encoding "nulls"', done)
     })
   })
 })
@@ -718,7 +839,9 @@ function createApp (options) {
 
   app.use(function (err, req, res, next) {
     res.status(err.status || 500)
-    res.send(String(err[req.headers['x-error-property'] || 'message']))
+    res.send(String(req.headers['x-error-property']
+      ? err[req.headers['x-error-property']]
+      : ('[' + err.type + '] ' + err.message)))
   })
 
   app.post('/', function (req, res) {
@@ -733,3 +856,11 @@ function expectKeyCount (count) {
     assert.strictEqual(Object.keys(JSON.parse(res.text)).length, count)
   }
 }
+
+function tryRequire (name) {
+  try {
+    return require(name)
+  } catch (e) {
+    return {}
+  }
+}

From 1df75763e315bd0582669238cd14baadec1d6db5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 2 Apr 2022 21:56:41 -0400
Subject: [PATCH 333/479] deps: qs@6.10.3

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index cba82afcbd2..ef5ce5fc020 100644
--- a/History.md
+++ b/History.md
@@ -26,6 +26,7 @@ unreleased
     - Remove set content headers that break response
     - deps: on-finished@2.4.1
     - deps: statuses@2.0.1
+  * deps: qs@6.10.3
   * deps: send@0.18.0
     - Fix emitted 416 error missing headers property
     - Limit the headers removed for 304 response
diff --git a/package.json b/package.json
index ce6604bd7dd..04e39b06e1e 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.7",
-    "qs": "6.9.7",
+    "qs": "6.10.3",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
     "send": "0.18.0",

From 980d881e3b023db079de60477a2588a91f046ca5 Mon Sep 17 00:00:00 2001
From: 3imed-jaberi <imed_jebari@hotmail.fr>
Date: Fri, 3 Jul 2020 05:38:59 +0200
Subject: [PATCH 334/479] deps: statuses@2.0.1

closes #4336
---
 History.md      | 3 +++
 lib/response.js | 8 ++++----
 package.json    | 2 +-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index ef5ce5fc020..ef9bbb6e427 100644
--- a/History.md
+++ b/History.md
@@ -37,6 +37,9 @@ unreleased
     - deps: statuses@2.0.1
   * deps: serve-static@1.15.0
     - deps: send@0.18.0
+  * deps: statuses@2.0.1
+    - Remove code 306
+    - Rename `425 Unordered Collection` to standard `425 Too Early`
 
 4.17.3 / 2022-02-16
 ===================
diff --git a/lib/response.js b/lib/response.js
index d9b8db1c201..fede486c06d 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -139,7 +139,7 @@ res.send = function send(body) {
 
     deprecate('res.send(status): Use res.sendStatus(status) instead');
     this.statusCode = chunk;
-    chunk = statuses[chunk]
+    chunk = statuses.message[chunk]
   }
 
   switch (typeof chunk) {
@@ -367,7 +367,7 @@ res.jsonp = function jsonp(obj) {
  */
 
 res.sendStatus = function sendStatus(statusCode) {
-  var body = statuses[statusCode] || String(statusCode)
+  var body = statuses.message[statusCode] || String(statusCode)
 
   this.statusCode = statusCode;
   this.type('txt');
@@ -955,12 +955,12 @@ res.redirect = function redirect(url) {
   // Support text/{plain,html} by default
   this.format({
     text: function(){
-      body = statuses[status] + '. Redirecting to ' + address
+      body = statuses.message[status] + '. Redirecting to ' + address
     },
 
     html: function(){
       var u = escapeHtml(address);
-      body = '<p>' + statuses[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>'
+      body = '<p>' + statuses.message[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>'
     },
 
     default: function(){
diff --git a/package.json b/package.json
index 04e39b06e1e..1e1f6740977 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
     "send": "0.18.0",
     "serve-static": "1.15.0",
     "setprototypeof": "1.2.0",
-    "statuses": "~1.5.0",
+    "statuses": "2.0.1",
     "type-is": "~1.6.18",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"

From 2e2d78c4d99829250018c6e4d20f3c6377a90683 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 3 Apr 2022 01:15:37 -0400
Subject: [PATCH 335/479] deps: on-finished@2.4.1

---
 History.md           |   2 +
 package.json         |   2 +-
 test/res.download.js |  73 ++++++++++++++++++++++++
 test/res.sendFile.js | 129 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 205 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ef9bbb6e427..84efe9b4d8a 100644
--- a/History.md
+++ b/History.md
@@ -26,6 +26,8 @@ unreleased
     - Remove set content headers that break response
     - deps: on-finished@2.4.1
     - deps: statuses@2.0.1
+  * deps: on-finished@2.4.1
+    - Prevent loss of async hooks context
   * deps: qs@6.10.3
   * deps: send@0.18.0
     - Fix emitted 416 error missing headers property
diff --git a/package.json b/package.json
index 1e1f6740977..dfce12352ca 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "http-errors": "2.0.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
-    "on-finished": "~2.3.0",
+    "on-finished": "2.4.1",
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.7",
diff --git a/test/res.download.js b/test/res.download.js
index 91b074e8bf6..b52e66803c6 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,6 +1,8 @@
 'use strict'
 
 var after = require('after');
+var assert = require('assert')
+var asyncHooks = tryRequire('async_hooks')
 var Buffer = require('safe-buffer').Buffer
 var express = require('..');
 var path = require('path')
@@ -9,6 +11,10 @@ var utils = require('./support/utils')
 
 var FIXTURES_PATH = path.join(__dirname, 'fixtures')
 
+var describeAsyncHooks = typeof asyncHooks.AsyncLocalStorage === 'function'
+  ? describe
+  : describe.skip
+
 describe('res', function(){
   describe('.download(path)', function(){
     it('should transfer as an attachment', function(done){
@@ -84,6 +90,65 @@ describe('res', function(){
       .expect('Content-Disposition', 'attachment; filename="user.html"')
       .expect(200, cb);
     })
+
+    describeAsyncHooks('async local storage', function () {
+      it('should presist store', function (done) {
+        var app = express()
+        var cb = after(2, done)
+        var store = { foo: 'bar' }
+
+        app.use(function (req, res, next) {
+          req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+          req.asyncLocalStorage.run(store, next)
+        })
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/name.txt', function (err) {
+            if (err) return cb(err)
+
+            var local = req.asyncLocalStorage.getStore()
+
+            assert.strictEqual(local.foo, 'bar')
+            cb()
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect('Content-Type', 'text/plain; charset=UTF-8')
+          .expect('Content-Disposition', 'attachment; filename="name.txt"')
+          .expect(200, 'tobi', cb)
+      })
+
+      it('should presist store on error', function (done) {
+        var app = express()
+        var store = { foo: 'bar' }
+
+        app.use(function (req, res, next) {
+          req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+          req.asyncLocalStorage.run(store, next)
+        })
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/does-not-exist', function (err) {
+            var local = req.asyncLocalStorage.getStore()
+
+            if (local) {
+              res.setHeader('x-store-foo', String(local.foo))
+            }
+
+            res.send(err ? 'got ' + err.status + ' error' : 'no error')
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('x-store-foo', 'bar')
+          .expect('got 404 error')
+          .end(done)
+      })
+    })
   })
 
   describe('.download(path, options)', function () {
@@ -423,3 +488,11 @@ describe('res', function(){
     })
   })
 })
+
+function tryRequire (name) {
+  try {
+    return require(name)
+  } catch (e) {
+    return {}
+  }
+}
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index e828c17e255..ba5c33516b1 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -1,6 +1,7 @@
 'use strict'
 
 var after = require('after');
+var asyncHooks = tryRequire('async_hooks')
 var Buffer = require('safe-buffer').Buffer
 var express = require('../')
   , request = require('supertest')
@@ -10,6 +11,10 @@ var path = require('path');
 var fixtures = path.join(__dirname, 'fixtures');
 var utils = require('./support/utils');
 
+var describeAsyncHooks = typeof asyncHooks.AsyncLocalStorage === 'function'
+  ? describe
+  : describe.skip
+
 describe('res', function(){
   describe('.sendFile(path)', function () {
     it('should error missing path', function (done) {
@@ -261,6 +266,64 @@ describe('res', function(){
         .get('/')
         .expect(200, 'got 404 error', done)
     })
+
+    describeAsyncHooks('async local storage', function () {
+      it('should presist store', function (done) {
+        var app = express()
+        var cb = after(2, done)
+        var store = { foo: 'bar' }
+
+        app.use(function (req, res, next) {
+          req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+          req.asyncLocalStorage.run(store, next)
+        })
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
+            if (err) return cb(err)
+
+            var local = req.asyncLocalStorage.getStore()
+
+            assert.strictEqual(local.foo, 'bar')
+            cb()
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect('Content-Type', 'text/plain; charset=UTF-8')
+          .expect(200, 'tobi', cb)
+      })
+
+      it('should presist store on error', function (done) {
+        var app = express()
+        var store = { foo: 'bar' }
+
+        app.use(function (req, res, next) {
+          req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+          req.asyncLocalStorage.run(store, next)
+        })
+
+        app.use(function (req, res) {
+          res.sendFile(path.resolve(fixtures, 'does-not-exist'), function (err) {
+            var local = req.asyncLocalStorage.getStore()
+
+            if (local) {
+              res.setHeader('x-store-foo', String(local.foo))
+            }
+
+            res.send(err ? 'got ' + err.status + ' error' : 'no error')
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('x-store-foo', 'bar')
+          .expect('got 404 error')
+          .end(done)
+      })
+    })
   })
 
   describe('.sendFile(path, options)', function () {
@@ -999,6 +1062,64 @@ describe('res', function(){
       .get('/')
       .end(function(){});
     })
+
+    describeAsyncHooks('async local storage', function () {
+      it('should presist store', function (done) {
+        var app = express()
+        var cb = after(2, done)
+        var store = { foo: 'bar' }
+
+        app.use(function (req, res, next) {
+          req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+          req.asyncLocalStorage.run(store, next)
+        })
+
+        app.use(function (req, res) {
+          res.sendfile('test/fixtures/name.txt', function (err) {
+            if (err) return cb(err)
+
+            var local = req.asyncLocalStorage.getStore()
+
+            assert.strictEqual(local.foo, 'bar')
+            cb()
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect('Content-Type', 'text/plain; charset=UTF-8')
+          .expect(200, 'tobi', cb)
+      })
+
+      it('should presist store on error', function (done) {
+        var app = express()
+        var store = { foo: 'bar' }
+
+        app.use(function (req, res, next) {
+          req.asyncLocalStorage = new asyncHooks.AsyncLocalStorage()
+          req.asyncLocalStorage.run(store, next)
+        })
+
+        app.use(function (req, res) {
+          res.sendfile('test/fixtures/does-not-exist', function (err) {
+            var local = req.asyncLocalStorage.getStore()
+
+            if (local) {
+              res.setHeader('x-store-foo', String(local.foo))
+            }
+
+            res.send(err ? 'got ' + err.status + ' error' : 'no error')
+          })
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('x-store-foo', 'bar')
+          .expect('got 404 error')
+          .end(done)
+      })
+    })
   })
 
   describe('.sendfile(path)', function(){
@@ -1280,3 +1401,11 @@ function createApp(path, options, fn) {
 
   return app;
 }
+
+function tryRequire (name) {
+  try {
+    return require(name)
+  } catch (e) {
+    return {}
+  }
+}

From 04da4aaf1a484e81856fc4713340300e4d84d573 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Apr 2022 19:17:10 -0400
Subject: [PATCH 336/479] build: use supertest@3.4.2 for Node.js 6.x

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b153d1b436..83a8edee87d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,7 +61,7 @@ jobs:
 
         - name: Node.js 6.x
           node-version: "6.17"
-          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@3.4.2
 
         - name: Node.js 7.x
           node-version: "7.10"
diff --git a/appveyor.yml b/appveyor.yml
index 2a2507b411b..93ea2c81616 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -71,11 +71,11 @@ install:
   - ps: |
       # supertest for http calls
       # - use 2.0.0 for Node.js < 4
-      # - use 3.4.2 for Node.js < 6
+      # - use 3.4.2 for Node.js < 7
       # - use 6.1.6 for Node.js < 8
       if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev supertest@2.0.0
-      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 7) {
         npm install --silent --save-dev supertest@3.4.2
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 8) {
         npm install --silent --save-dev supertest@6.1.6

From 1b2e097be2f5b62b7db7dae09f399ace54836e0a Mon Sep 17 00:00:00 2001
From: Hashen <37979557+Hashen110@users.noreply.github.com>
Date: Thu, 7 Apr 2022 21:14:16 +0530
Subject: [PATCH 337/479] tests: fix typo in description

closes #4882
---
 test/res.sendFile.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index ba5c33516b1..eb71adeb6a8 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -747,7 +747,7 @@ describe('res', function(){
       })
 
       describe('when cacheControl: false', function () {
-        it('shold not send cache-control', function (done) {
+        it('should not send cache-control', function (done) {
           var app = express()
 
           app.use(function (req, res) {

From 99175c3ef63166d199bab8f402103522dec5f0ee Mon Sep 17 00:00:00 2001
From: Ghouse Mohamed <ghousemohamed7126@gmail.com>
Date: Sun, 27 Mar 2022 05:15:01 +0530
Subject: [PATCH 338/479] docs: fix typo in casing of HTTP

closes #4872
---
 Charter.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Charter.md b/Charter.md
index f9647cb734d..a906e52909a 100644
--- a/Charter.md
+++ b/Charter.md
@@ -9,7 +9,7 @@ also easily visible to outsiders.
 
 ## Section 1: Scope
 
-Express is a http web server framework with a simple and expressive API
+Express is a HTTP web server framework with a simple and expressive API
 which is highly aligned with Node.js core. We aim to be the best in
 class for writing performant, spec compliant, and powerful web servers
 in Node.js. As one of the oldest and most popular web frameworks in
@@ -24,7 +24,7 @@ Express is made of many modules spread between three GitHub Orgs:
   libraries
 - [pillarjs](http://github.com/pillarjs/): Components which make up
   Express but can also be used for other web frameworks
-- [jshttp](http://github.com/jshttp/): Low level http libraries
+- [jshttp](http://github.com/jshttp/): Low level HTTP libraries
 
 ### 1.2: Out-of-Scope
 

From ecaf67c9305f3bf75a9798e8a2e10b36955df42c Mon Sep 17 00:00:00 2001
From: Eslam Salem <eslam@shieldfy.com>
Date: Mon, 11 Apr 2022 10:56:45 +0200
Subject: [PATCH 339/479] docs: remove Node Security Project from security
 policy

closes #4890
---
 Security.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Security.md b/Security.md
index 858dfffc5bc..cdcd7a6e0aa 100644
--- a/Security.md
+++ b/Security.md
@@ -27,8 +27,7 @@ endeavor to keep you informed of the progress towards a fix and full
 announcement, and may ask for additional information or guidance.
 
 Report security bugs in third-party modules to the person or team maintaining
-the module. You can also report a vulnerability through the
-[Node Security Project](https://nodesecurity.io/report).
+the module.
 
 ## Disclosure Policy
 

From b91c7ffb289af1753b9d1d84e16fbfcd34954124 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 11 Apr 2022 19:28:50 -0400
Subject: [PATCH 340/479] examples: use http-errors to create errors

---
 examples/params/index.js | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/examples/params/index.js b/examples/params/index.js
index b153b93b988..b6fc483c8b7 100644
--- a/examples/params/index.js
+++ b/examples/params/index.js
@@ -4,6 +4,7 @@
  * Module dependencies.
  */
 
+var createError = require('http-errors')
 var express = require('../../');
 var app = module.exports = express();
 
@@ -17,14 +18,6 @@ var users = [
   , { name: 'bandit' }
 ];
 
-// Create HTTP error
-
-function createError(status, message) {
-  var err = new Error(message);
-  err.status = status;
-  return err;
-}
-
 // Convert :to and :from to integers
 
 app.param(['to', 'from'], function(req, res, next, num, name){

From 8880ddad1c0f00612b53f5f686f55e7566b16562 Mon Sep 17 00:00:00 2001
From: Hashen <37979557+Hashen110@users.noreply.github.com>
Date: Thu, 7 Apr 2022 21:34:47 +0530
Subject: [PATCH 341/479] examples: add missing html label associations

closes #4884
---
 examples/auth/views/login.ejs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/examples/auth/views/login.ejs b/examples/auth/views/login.ejs
index 8a20411a2ca..181c36caf7a 100644
--- a/examples/auth/views/login.ejs
+++ b/examples/auth/views/login.ejs
@@ -6,12 +6,12 @@
 Try accessing <a href="/restricted">/restricted</a>, then authenticate with "tj" and "foobar".
 <form method="post" action="/login">
   <p>
-    <label>Username:</label>
-    <input type="text" name="username">
+    <label for="username">Username:</label>
+    <input type="text" name="username" id="username">
   </p>
   <p>
-    <label>Password:</label>
-    <input type="text" name="password">
+    <label for="password">Password:</label>
+    <input type="text" name="password" id="password">
   </p>
   <p>
     <input type="submit" value="Login">

From 92c5ce59f51cce4b3598fd040117772fac42dce8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 11 Apr 2022 22:51:13 -0400
Subject: [PATCH 342/479] deps: cookie@0.5.0

---
 History.md         |  3 ++
 package.json       |  2 +-
 test/res.cookie.js | 72 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 84efe9b4d8a..4f43ad92550 100644
--- a/History.md
+++ b/History.md
@@ -19,6 +19,9 @@ unreleased
     - deps: on-finished@2.4.1
     - deps: qs@6.10.3
     - deps: raw-body@2.5.1
+  * deps: cookie@0.5.0
+    - Add `priority` option
+    - Fix `expires` option to reject invalid dates
   * deps: depd@2.0.0
     - Replace internal `eval` usage with `Function` constructor
     - Use instance methods on `process` to check for listeners
diff --git a/package.json b/package.json
index dfce12352ca..ede86798cf6 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "body-parser": "1.20.0",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
-    "cookie": "0.4.2",
+    "cookie": "0.5.0",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "2.0.0",
diff --git a/test/res.cookie.js b/test/res.cookie.js
index e3a921301f4..93deb769887 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -67,6 +67,21 @@ describe('res', function(){
       .expect(200, done)
     })
 
+    describe('expires', function () {
+      it('should throw on invalid date', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { expires: new Date(NaN) })
+          res.end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(500, /option expires is invalid/, done)
+      })
+    })
+
     describe('maxAge', function(){
       it('should set relative expires', function(done){
         var app = express();
@@ -155,6 +170,63 @@ describe('res', function(){
       })
     })
 
+    describe('priority', function () {
+      it('should set low priority', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { priority: 'low' })
+          res.end()
+        })
+
+        request(app)
+          .get('/')
+          .expect('Set-Cookie', /Priority=Low/)
+          .expect(200, done)
+      })
+
+      it('should set medium priority', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { priority: 'medium' })
+          res.end()
+        })
+
+        request(app)
+          .get('/')
+          .expect('Set-Cookie', /Priority=Medium/)
+          .expect(200, done)
+      })
+
+      it('should set high priority', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { priority: 'high' })
+          res.end()
+        })
+
+        request(app)
+          .get('/')
+          .expect('Set-Cookie', /Priority=High/)
+          .expect(200, done)
+      })
+
+      it('should throw with invalid priority', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { priority: 'foobar' })
+          res.end()
+        })
+
+        request(app)
+          .get('/')
+          .expect(500, /option priority is invalid/, done)
+      })
+    })
+
     describe('signed', function(){
       it('should generate a signed JSON cookie', function(done){
         var app = express();

From 708ac4cdf5cd0a658d62490a9f4d78d3e1ec6612 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 13 Apr 2022 23:29:25 -0400
Subject: [PATCH 343/479] Fix handling very large stacks of sync middleware

closes #4891
---
 History.md          |  1 +
 lib/router/index.js |  8 ++++++++
 lib/router/route.js |  9 +++++++++
 test/Route.js       | 22 ++++++++++++++++++++++
 test/Router.js      | 16 ++++++++++++++++
 5 files changed, 56 insertions(+)

diff --git a/History.md b/History.md
index 4f43ad92550..3f7851ba578 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Allow `options` without `filename` in `res.download`
   * Deprecate string and non-integer arguments to `res.status`
   * Fix behavior of `null`/`undefined` as `maxAge` in `res.cookie`
+  * Fix handling very large stacks of sync middleware
   * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
   * Invoke `default` with same arguments as types in `res.format`
   * Support proper 205 responses using `res.send`
diff --git a/lib/router/index.js b/lib/router/index.js
index 791a600f86a..f4c8c0a79ef 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -142,6 +142,7 @@ proto.handle = function handle(req, res, out) {
   var protohost = getProtohost(req.url) || ''
   var removed = '';
   var slashAdded = false;
+  var sync = 0
   var paramcalled = {};
 
   // store options for OPTIONS request
@@ -203,6 +204,11 @@ proto.handle = function handle(req, res, out) {
       return;
     }
 
+    // max sync stack
+    if (++sync > 100) {
+      return setImmediate(next, err)
+    }
+
     // get pathname of request
     var path = getPathname(req);
 
@@ -321,6 +327,8 @@ proto.handle = function handle(req, res, out) {
     } else {
       layer.handle_request(req, res, next);
     }
+
+    sync = 0
   }
 };
 
diff --git a/lib/router/route.js b/lib/router/route.js
index 178df0d5160..5adaa125e27 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -98,6 +98,8 @@ Route.prototype._options = function _options() {
 Route.prototype.dispatch = function dispatch(req, res, done) {
   var idx = 0;
   var stack = this.stack;
+  var sync = 0
+
   if (stack.length === 0) {
     return done();
   }
@@ -127,6 +129,11 @@ Route.prototype.dispatch = function dispatch(req, res, done) {
       return done(err);
     }
 
+    // max sync stack
+    if (++sync > 100) {
+      return setImmediate(next, err)
+    }
+
     if (layer.method && layer.method !== method) {
       return next(err);
     }
@@ -136,6 +143,8 @@ Route.prototype.dispatch = function dispatch(req, res, done) {
     } else {
       layer.handle_request(req, res, next);
     }
+
+    sync = 0
   }
 };
 
diff --git a/test/Route.js b/test/Route.js
index 8e7ddbdbcc1..3bdc8d7df2f 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -13,6 +13,28 @@ describe('Route', function(){
     route.dispatch(req, {}, done)
   })
 
+  it('should not stack overflow with a large sync stack', function (done) {
+    this.timeout(5000) // long-running test
+
+    var req = { method: 'GET', url: '/' }
+    var route = new Route('/foo')
+
+    for (var i = 0; i < 6000; i++) {
+      route.all(function (req, res, next) { next() })
+    }
+
+    route.get(function (req, res, next) {
+      req.called = true
+      next()
+    })
+
+    route.dispatch(req, {}, function (err) {
+      if (err) return done(err)
+      assert.ok(req.called)
+      done()
+    })
+  })
+
   describe('.all', function(){
     it('should add handler', function(done){
       var req = { method: 'GET', url: '/' };
diff --git a/test/Router.js b/test/Router.js
index 907b9726361..8a0654bca3c 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -76,6 +76,22 @@ describe('Router', function(){
     router.handle({ url: '/', method: 'GET' }, { end: done });
   });
 
+  it('should not stack overflow with a large sync stack', function (done) {
+    this.timeout(5000) // long-running test
+
+    var router = new Router()
+
+    for (var i = 0; i < 6000; i++) {
+      router.use(function (req, res, next) { next() })
+    }
+
+    router.use(function (req, res) {
+      res.end()
+    })
+
+    router.handle({ url: '/', method: 'GET' }, { end: done })
+  })
+
   describe('.handle', function(){
     it('should dispatch', function(done){
       var router = new Router();

From fd8e45c344325a4a91c1b916f3617a3574018976 Mon Sep 17 00:00:00 2001
From: phoenix <felix.niederwanger@suse.com>
Date: Fri, 8 Apr 2022 10:31:27 +0200
Subject: [PATCH 344/479] tests: mark stack overflow as long running

closes #4887
---
 test/Router.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/Router.js b/test/Router.js
index 8a0654bca3c..bf5a31ffddb 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -62,6 +62,8 @@ describe('Router', function(){
   })
 
   it('should not stack overflow with many registered routes', function(done){
+    this.timeout(5000) // long-running test
+
     var handler = function(req, res){ res.end(new Error('wrong handler')) };
     var router = new Router();
 

From 11a209e4b7e229bf5041e1ab76ba0ac4e0cad324 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 20 Apr 2022 22:02:37 -0400
Subject: [PATCH 345/479] build: support Node.js 17.x

---
 .github/workflows/ci.yml | 4 ++++
 appveyor.yml             | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 83a8edee87d..f4a5902ac95 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,6 +29,7 @@ jobs:
         - Node.js 14.x
         - Node.js 15.x
         - Node.js 16.x
+        - Node.js 17.x
 
         include:
         - name: Node.js 0.10
@@ -98,6 +99,9 @@ jobs:
         - name: Node.js 16.x
           node-version: "16.14"
 
+        - name: Node.js 17.x
+          node-version: "17.9"
+
     steps:
     - uses: actions/checkout@v2
 
diff --git a/appveyor.yml b/appveyor.yml
index 93ea2c81616..f97addec1cb 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -18,6 +18,7 @@ environment:
     - nodejs_version: "14.19"
     - nodejs_version: "15.14"
     - nodejs_version: "16.14"
+    - nodejs_version: "17.9"
 cache:
   - node_modules
 install:

From 29ea1b2f74c5e76e79e329ef425e5fbbcd6a71c3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Apr 2022 01:38:59 -0400
Subject: [PATCH 346/479] build: use 64-bit Node.js in AppVeyor

---
 appveyor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/appveyor.yml b/appveyor.yml
index f97addec1cb..faf31abf12f 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -25,7 +25,7 @@ install:
   # Install Node.js
   - ps: >-
       try { Install-Product node $env:nodejs_version -ErrorAction Stop }
-      catch { Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version) }
+      catch { Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version) x64 }
   # Configure npm
   - ps: |
       npm config set loglevel error

From 158a17031a2668269aedb31ea07b58d6b700272b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Apr 2022 02:09:08 -0400
Subject: [PATCH 347/479] build: support Node.js 18.x

---
 .github/workflows/ci.yml | 4 ++++
 appveyor.yml             | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f4a5902ac95..9d3663762c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,6 +30,7 @@ jobs:
         - Node.js 15.x
         - Node.js 16.x
         - Node.js 17.x
+        - Node.js 18.x
 
         include:
         - name: Node.js 0.10
@@ -102,6 +103,9 @@ jobs:
         - name: Node.js 17.x
           node-version: "17.9"
 
+        - name: Node.js 18.x
+          node-version: "18.0"
+
     steps:
     - uses: actions/checkout@v2
 
diff --git a/appveyor.yml b/appveyor.yml
index faf31abf12f..8804cfd398c 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,6 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.14"
     - nodejs_version: "17.9"
+    - nodejs_version: "18.0"
 cache:
   - node_modules
 install:

From 0b330ef57c0801313251c95a461d93f8d3afa7f7 Mon Sep 17 00:00:00 2001
From: Deniz <denizy@protonmail.com>
Date: Mon, 4 Apr 2022 01:31:32 +0200
Subject: [PATCH 348/479] bench: print latency and vary connections

closes #4880
---
 benchmarks/Makefile | 20 ++++++++++++--------
 benchmarks/run      |  8 +++++---
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/benchmarks/Makefile b/benchmarks/Makefile
index baf0d6fce92..ed1ddfc4f34 100644
--- a/benchmarks/Makefile
+++ b/benchmarks/Makefile
@@ -1,13 +1,17 @@
 
 all:
-	@./run 1 middleware
-	@./run 5 middleware
-	@./run 10 middleware
-	@./run 15 middleware
-	@./run 20 middleware
-	@./run 30 middleware
-	@./run 50 middleware
-	@./run 100 middleware
+	@./run 1 middleware 50
+	@./run 5 middleware 50
+	@./run 10 middleware 50
+	@./run 15 middleware 50
+	@./run 20 middleware 50
+	@./run 30 middleware 50
+	@./run 50 middleware 50
+	@./run 100 middleware 50
+	@./run 10 middleware 100
+	@./run 10 middleware 250
+	@./run 10 middleware 500
+	@./run 10 middleware 1000
 	@echo
 
 .PHONY: all
diff --git a/benchmarks/run b/benchmarks/run
index 93b5bc52ff2..ec8f55d5643 100755
--- a/benchmarks/run
+++ b/benchmarks/run
@@ -4,13 +4,15 @@ echo
 MW=$1 node $2 &
 pid=$!
 
+echo "  $3 connections"
+
 sleep 2
 
 wrk 'http://localhost:3333/?foo[bar]=baz' \
   -d 3 \
-  -c 50 \
+  -c $3 \
   -t 8 \
-  | grep 'Requests/sec' \
-  | awk '{ print "  " $2 }'
+  | grep 'Requests/sec\|Latency' \
+  | awk '{ print " " $2 }'
 
 kill $pid

From 547fdd41dca9ae9c49956748cc0bd1f011310fb6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Apr 2022 14:53:28 -0400
Subject: [PATCH 349/479] 4.18.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3f7851ba578..32e75b391e4 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.18.0 / 2022-04-25
+===================
 
   * Add "root" option to `res.download`
   * Allow `options` without `filename` in `res.download`
diff --git a/package.json b/package.json
index ede86798cf6..d07cdf82b98 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.17.3",
+  "version": "4.18.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From a38fae126a9d5681d075c1a5c44fd7357eae843b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Apr 2022 13:04:11 -0400
Subject: [PATCH 350/479] build: mocha@9.2.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d07cdf82b98..da94b92fd4d 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "hbs": "4.2.0",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "9.2.1",
+    "mocha": "9.2.2",
     "morgan": "1.10.0",
     "multiparty": "4.2.3",
     "nyc": "15.1.0",

From 2df96e349f49bbcf51126c1f3b93b3b7fe8c16d2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Apr 2022 13:04:38 -0400
Subject: [PATCH 351/479] build: supertest@6.2.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index da94b92fd4d..0499571ed4a 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "multiparty": "4.2.3",
     "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
-    "supertest": "6.2.2",
+    "supertest": "6.2.3",
     "vhost": "~3.0.2"
   },
   "engines": {

From e2482b7e36e39fd9875508a297c2db4a80a33635 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Apr 2022 21:59:32 -0400
Subject: [PATCH 352/479] build: ejs@3.1.7

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0499571ed4a..f0781ddfd48 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
     "connect-redis": "3.4.2",
     "cookie-parser": "1.4.6",
     "cookie-session": "2.0.0",
-    "ejs": "3.1.6",
+    "ejs": "3.1.7",
     "eslint": "7.32.0",
     "express-session": "1.17.2",
     "hbs": "4.2.0",

From 75e0c7a2c91665f44d053d83be15f8ecd0177f41 Mon Sep 17 00:00:00 2001
From: Hashen <37979557+Hashen110@users.noreply.github.com>
Date: Tue, 26 Apr 2022 23:23:14 +0530
Subject: [PATCH 353/479] bench: remove unused parameter

closes #4898
---
 benchmarks/middleware.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/benchmarks/middleware.js b/benchmarks/middleware.js
index df4df2c5ac5..fed97ba8ce4 100644
--- a/benchmarks/middleware.js
+++ b/benchmarks/middleware.js
@@ -13,7 +13,7 @@ while (n--) {
   });
 }
 
-app.use(function(req, res, next){
+app.use(function(req, res){
   res.send('Hello World')
 });
 

From 631ada0c645dc84c6df8788f5a7eb2b8100acea5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Apr 2022 13:34:47 -0400
Subject: [PATCH 354/479] Fix hanging on large stack of sync routes

fixes #4899
---
 History.md          |  5 +++++
 lib/router/index.js | 14 ++++++--------
 test/Router.js      | 18 +++++++++++++++++-
 3 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/History.md b/History.md
index 32e75b391e4..b052c577f78 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix hanging on large stack of sync routes
+
 4.18.0 / 2022-04-25
 ===================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index f4c8c0a79ef..5174c34f455 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -279,14 +279,14 @@ proto.handle = function handle(req, res, out) {
     // this should be done for the layer
     self.process_params(layer, paramcalled, req, res, function (err) {
       if (err) {
-        return next(layerError || err);
+        next(layerError || err)
+      } else if (route) {
+        layer.handle_request(req, res, next)
+      } else {
+        trim_prefix(layer, layerError, layerPath, path)
       }
 
-      if (route) {
-        return layer.handle_request(req, res, next);
-      }
-
-      trim_prefix(layer, layerError, layerPath, path);
+      sync = 0
     });
   }
 
@@ -327,8 +327,6 @@ proto.handle = function handle(req, res, out) {
     } else {
       layer.handle_request(req, res, next);
     }
-
-    sync = 0
   }
 };
 
diff --git a/test/Router.js b/test/Router.js
index bf5a31ffddb..fcfee80625c 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -78,7 +78,23 @@ describe('Router', function(){
     router.handle({ url: '/', method: 'GET' }, { end: done });
   });
 
-  it('should not stack overflow with a large sync stack', function (done) {
+  it('should not stack overflow with a large sync route stack', function (done) {
+    this.timeout(5000) // long-running test
+
+    var router = new Router()
+
+    for (var i = 0; i < 6000; i++) {
+      router.get('/foo', function (req, res, next) { next() })
+    }
+
+    router.get('/foo', function (req, res) {
+      res.end()
+    })
+
+    router.handle({ url: '/foo', method: 'GET' }, { end: done })
+  })
+
+  it('should not stack overflow with a large sync middleware stack', function (done) {
     this.timeout(5000) // long-running test
 
     var router = new Router()

From b02a95c6937e3b7e0b85a51c7e1a7366e1699dce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Apr 2022 14:52:20 -0400
Subject: [PATCH 355/479] build: Node.js@16.15

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9d3663762c6..a4b40dc982f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.14"
+          node-version: "16.15"
 
         - name: Node.js 17.x
           node-version: "17.9"
diff --git a/appveyor.yml b/appveyor.yml
index 8804cfd398c..80802e180e6 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -17,7 +17,7 @@ environment:
     - nodejs_version: "13.14"
     - nodejs_version: "14.19"
     - nodejs_version: "15.14"
-    - nodejs_version: "16.14"
+    - nodejs_version: "16.15"
     - nodejs_version: "17.9"
     - nodejs_version: "18.0"
 cache:

From d854c43ea177d1faeea56189249fff8c24a764bd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Apr 2022 15:32:26 -0400
Subject: [PATCH 356/479] 4.18.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b052c577f78..4c12ec97355 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.18.1 / 2022-04-29
+===================
 
   * Fix hanging on large stack of sync routes
 
diff --git a/package.json b/package.json
index f0781ddfd48..f5872a53336 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.18.0",
+  "version": "4.18.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From a2dfc56a4982e0a33c67d6d0c22e087e95bff79e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 May 2022 09:33:19 -0400
Subject: [PATCH 357/479] build: mocha@10.0.0

---
 .github/workflows/ci.yml | 2 ++
 appveyor.yml             | 3 +++
 package.json             | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4b40dc982f..6df74b37f8f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,9 +87,11 @@ jobs:
 
         - name: Node.js 12.x
           node-version: "12.22"
+          npm-i: mocha@9.2.2
 
         - name: Node.js 13.x
           node-version: "13.14"
+          npm-i: mocha@9.2.2
 
         - name: Node.js 14.x
           node-version: "14.19"
diff --git a/appveyor.yml b/appveyor.yml
index 80802e180e6..e9b28e7d0fa 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -47,6 +47,7 @@ install:
       # - use 6.x for Node.js < 8
       # - use 7.x for Node.js < 10
       # - use 8.x for Node.js < 12
+      # - use 9.x for Node.js < 14
       if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev mocha@3.5.3
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
@@ -57,6 +58,8 @@ install:
         npm install --silent --save-dev mocha@7.2.0
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 12) {
         npm install --silent --save-dev mocha@8.4.0
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 14) {
+        npm install --silent --save-dev mocha@9.2.2
       }
   - ps: |
       # nyc for test coverage
diff --git a/package.json b/package.json
index f5872a53336..6880db25241 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "hbs": "4.2.0",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "9.2.2",
+    "mocha": "10.0.0",
     "morgan": "1.10.0",
     "multiparty": "4.2.3",
     "nyc": "15.1.0",

From 745a63f8256828a061e1b2f0a5f8e52eb9538da1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 May 2022 09:34:47 -0400
Subject: [PATCH 358/479] build: ejs@3.1.8

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6880db25241..3430f770972 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
     "connect-redis": "3.4.2",
     "cookie-parser": "1.4.6",
     "cookie-session": "2.0.0",
-    "ejs": "3.1.7",
+    "ejs": "3.1.8",
     "eslint": "7.32.0",
     "express-session": "1.17.2",
     "hbs": "4.2.0",

From ab2c70b954ac2ceb3aaf466b0f59089999952dd0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 May 2022 09:35:20 -0400
Subject: [PATCH 359/479] build: Node.js@18.1

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6df74b37f8f..b7ad4578297 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -106,7 +106,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.0"
+          node-version: "18.1"
 
     steps:
     - uses: actions/checkout@v2
diff --git a/appveyor.yml b/appveyor.yml
index e9b28e7d0fa..b78a0b1550d 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,7 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.15"
     - nodejs_version: "17.9"
-    - nodejs_version: "18.0"
+    - nodejs_version: "18.1"
 cache:
   - node_modules
 install:

From 7ec5dd2b3c5e7379f68086dae72859f5573c8b9b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 May 2022 09:37:20 -0400
Subject: [PATCH 360/479] Fix regression routing a large stack in a single
 route

fixes #4913
---
 History.md          |  5 +++++
 lib/router/route.js | 16 ++++++++--------
 test/Route.js       | 11 ++++++++++-
 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/History.md b/History.md
index 4c12ec97355..cbf4b5249fa 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix regression routing a large stack in a single route
+
 4.18.1 / 2022-04-29
 ===================
 
diff --git a/lib/router/route.js b/lib/router/route.js
index 5adaa125e27..cc643ac8bdb 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -124,21 +124,21 @@ Route.prototype.dispatch = function dispatch(req, res, done) {
       return done(err)
     }
 
-    var layer = stack[idx++];
-    if (!layer) {
-      return done(err);
-    }
-
     // max sync stack
     if (++sync > 100) {
       return setImmediate(next, err)
     }
 
-    if (layer.method && layer.method !== method) {
-      return next(err);
+    var layer = stack[idx++]
+
+    // end of layers
+    if (!layer) {
+      return done(err)
     }
 
-    if (err) {
+    if (layer.method && layer.method !== method) {
+      next(err)
+    } else if (err) {
       layer.handle_error(err, req, res, next);
     } else {
       layer.handle_request(req, res, next);
diff --git a/test/Route.js b/test/Route.js
index 3bdc8d7df2f..64dbad60ce9 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -19,8 +19,16 @@ describe('Route', function(){
     var req = { method: 'GET', url: '/' }
     var route = new Route('/foo')
 
+    route.get(function (req, res, next) {
+      req.counter = 0
+      next()
+    })
+
     for (var i = 0; i < 6000; i++) {
-      route.all(function (req, res, next) { next() })
+      route.all(function (req, res, next) {
+        req.counter++
+        next()
+      })
     }
 
     route.get(function (req, res, next) {
@@ -31,6 +39,7 @@ describe('Route', function(){
     route.dispatch(req, {}, function (err) {
       if (err) return done(err)
       assert.ok(req.called)
+      assert.strictEqual(req.counter, 6000)
       done()
     })
   })

From 97f0a518d8d697e310abf293a71383cf9d04d749 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 May 2022 11:54:35 -0400
Subject: [PATCH 361/479] tests: verify all handlers called in stack tests

---
 test/Router.js | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/test/Router.js b/test/Router.js
index fcfee80625c..0d0502ab40d 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -83,11 +83,20 @@ describe('Router', function(){
 
     var router = new Router()
 
+    router.get('/foo', function (req, res, next) {
+      req.counter = 0
+      next()
+    })
+
     for (var i = 0; i < 6000; i++) {
-      router.get('/foo', function (req, res, next) { next() })
+      router.get('/foo', function (req, res, next) {
+        req.counter++
+        next()
+      })
     }
 
     router.get('/foo', function (req, res) {
+      assert.strictEqual(req.counter, 6000)
       res.end()
     })
 
@@ -99,11 +108,20 @@ describe('Router', function(){
 
     var router = new Router()
 
+    router.use(function (req, res, next) {
+      req.counter = 0
+      next()
+    })
+
     for (var i = 0; i < 6000; i++) {
-      router.use(function (req, res, next) { next() })
+      router.use(function (req, res, next) {
+        req.counter++
+        next()
+      })
     }
 
     router.use(function (req, res) {
+      assert.strictEqual(req.counter, 6000)
       res.end()
     })
 

From 2c47827053233e707536019a15499ccf5496dc9d Mon Sep 17 00:00:00 2001
From: Alexandru Dragomir <alexandru.dragomir2@gmail.com>
Date: Fri, 20 May 2022 18:49:44 +0300
Subject: [PATCH 362/479] examples: remove unused function arguments in params

closes #4914
---
 examples/params/index.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/params/index.js b/examples/params/index.js
index b6fc483c8b7..f3cd8457eb5 100644
--- a/examples/params/index.js
+++ b/examples/params/index.js
@@ -51,7 +51,7 @@ app.get('/', function(req, res){
  * GET :user.
  */
 
-app.get('/user/:user', function(req, res, next){
+app.get('/user/:user', function (req, res) {
   res.send('user ' + req.user.name);
 });
 
@@ -59,7 +59,7 @@ app.get('/user/:user', function(req, res, next){
  * GET users :from - :to.
  */
 
-app.get('/users/:from-:to', function(req, res, next){
+app.get('/users/:from-:to', function (req, res) {
   var from = req.params.from;
   var to = req.params.to;
   var names = users.map(function(user){ return user.name; });

From 8d98e86d7fe4e4dd50e42e73301b0bb7b7132758 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Aug 2022 23:00:36 -0400
Subject: [PATCH 363/479] build: Node.js@16.17

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b7ad4578297..5be813b2fed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -100,7 +100,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.15"
+          node-version: "16.17"
 
         - name: Node.js 17.x
           node-version: "17.9"
diff --git a/appveyor.yml b/appveyor.yml
index b78a0b1550d..ef183ed7d75 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -17,7 +17,7 @@ environment:
     - nodejs_version: "13.14"
     - nodejs_version: "14.19"
     - nodejs_version: "15.14"
-    - nodejs_version: "16.15"
+    - nodejs_version: "16.17"
     - nodejs_version: "17.9"
     - nodejs_version: "18.1"
 cache:

From 97131bcda8bd3cdbe53ef14fbd08dcc23a53e758 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Aug 2022 23:01:25 -0400
Subject: [PATCH 364/479] build: Node.js@18.7

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5be813b2fed..1ad8d117668 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -106,7 +106,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.1"
+          node-version: "18.7"
 
     steps:
     - uses: actions/checkout@v2
diff --git a/appveyor.yml b/appveyor.yml
index ef183ed7d75..071f0de0924 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,7 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.17"
     - nodejs_version: "17.9"
-    - nodejs_version: "18.1"
+    - nodejs_version: "18.7"
 cache:
   - node_modules
 install:

From ecd7572f1e920b7a512452b8d9806ae617a99c54 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Aug 2022 23:41:10 -0400
Subject: [PATCH 365/479] build: Node.js@14.20

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ad8d117668..5d2cef5a4d1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,7 +94,7 @@ jobs:
           npm-i: mocha@9.2.2
 
         - name: Node.js 14.x
-          node-version: "14.19"
+          node-version: "14.20"
 
         - name: Node.js 15.x
           node-version: "15.14"
diff --git a/appveyor.yml b/appveyor.yml
index 071f0de0924..7bf0141b380 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -15,7 +15,7 @@ environment:
     - nodejs_version: "11.15"
     - nodejs_version: "12.22"
     - nodejs_version: "13.14"
-    - nodejs_version: "14.19"
+    - nodejs_version: "14.20"
     - nodejs_version: "15.14"
     - nodejs_version: "16.17"
     - nodejs_version: "17.9"

From 644f6464b9f61cbafa8f880636b1aa5237d95bad Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Aug 2022 23:42:39 -0400
Subject: [PATCH 366/479] build: supertest@6.2.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3430f770972..cbfa910ff09 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "multiparty": "4.2.3",
     "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
-    "supertest": "6.2.3",
+    "supertest": "6.2.4",
     "vhost": "~3.0.2"
   },
   "engines": {

From 33e8dc303af9277f8a7e4f46abfdcb5e72f6797b Mon Sep 17 00:00:00 2001
From: REALSTEVEIG <101066723+REALSTEVEIG@users.noreply.github.com>
Date: Sat, 11 Jun 2022 21:26:10 +0100
Subject: [PATCH 367/479] docs: use Node.js name style

closes #4926
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 720bf389224..9b8bc34a0ce 100644
--- a/Readme.md
+++ b/Readme.md
@@ -1,6 +1,6 @@
 [![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/)
 
-  Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
+  Fast, unopinionated, minimalist web framework for [Node.js](http://nodejs.org).
 
   [![NPM Version][npm-version-image]][npm-url]
   [![NPM Install Size][npm-install-size-image]][npm-install-size-url]

From 340be0f79afb9b3176afb76235aa7f92acbd5050 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Oct 2022 22:40:51 -0400
Subject: [PATCH 368/479] build: eslint@8.24.0

---
 .github/workflows/ci.yml | 4 ++--
 package.json             | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5d2cef5a4d1..6125da491ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -133,8 +133,8 @@ jobs:
       shell: bash
       run: |
         # eslint for linting
-        # - remove on Node.js < 10
-        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
+        # - remove on Node.js < 12
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 12 ]]; then
           node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
             grep -E '^eslint(-|$)' | \
             sort -r | \
diff --git a/package.json b/package.json
index cbfa910ff09..defab0eec0d 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "cookie-parser": "1.4.6",
     "cookie-session": "2.0.0",
     "ejs": "3.1.8",
-    "eslint": "7.32.0",
+    "eslint": "8.24.0",
     "express-session": "1.17.2",
     "hbs": "4.2.0",
     "marked": "0.7.0",

From 689d175b8b39d8860b81d723233fb83d15201827 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 6 Oct 2022 10:26:18 -0400
Subject: [PATCH 369/479] deps: body-parser@1.20.1

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index cbf4b5249fa..389c837b089 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * Fix regression routing a large stack in a single route
+  * deps: body-parser@1.20.1
+    - deps: qs@6.11.0
+    - perf: remove unnecessary object clone
 
 4.18.1 / 2022-04-29
 ===================
diff --git a/package.json b/package.json
index defab0eec0d..2c2d40a73f7 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
   "dependencies": {
     "accepts": "~1.3.8",
     "array-flatten": "1.1.1",
-    "body-parser": "1.20.0",
+    "body-parser": "1.20.1",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
     "cookie": "0.5.0",

From 24b3dc551670ac4fb0cd5a2bd5ef643c9525e60f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 6 Oct 2022 10:27:01 -0400
Subject: [PATCH 370/479] deps: qs@6.11.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 389c837b089..a05baee6179 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * deps: body-parser@1.20.1
     - deps: qs@6.11.0
     - perf: remove unnecessary object clone
+  * deps: qs@6.11.0
 
 4.18.1 / 2022-04-29
 ===================
diff --git a/package.json b/package.json
index 2c2d40a73f7..a7815d9fbee 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.7",
-    "qs": "6.10.3",
+    "qs": "6.11.0",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
     "send": "0.18.0",

From f56ce73186e885a938bfdb3d3d1005a58e6ae12b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 6 Oct 2022 10:28:13 -0400
Subject: [PATCH 371/479] build: supertest@6.3.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a7815d9fbee..6a11013c72c 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "multiparty": "4.2.3",
     "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
-    "supertest": "6.2.4",
+    "supertest": "6.3.0",
     "vhost": "~3.0.2"
   },
   "engines": {

From bb7907b932afe3a19236a642f6054b6c8f7349a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 7 Oct 2022 17:48:59 -0400
Subject: [PATCH 372/479] build: Node.js@18.10

closes #5014
---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 test/res.sendFile.js     | 7 ++++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6125da491ad..cd93ab223d2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -106,7 +106,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.7"
+          node-version: "18.10"
 
     steps:
     - uses: actions/checkout@v2
diff --git a/appveyor.yml b/appveyor.yml
index 7bf0141b380..1fca21801e8 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,7 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.17"
     - nodejs_version: "17.9"
-    - nodejs_version: "18.7"
+    - nodejs_version: "18.10"
 cache:
   - node_modules
 install:
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index eb71adeb6a8..4db0a3b6a4e 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -1050,12 +1050,13 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/user.html', function(err){
-          assert(!res.headersSent);
-          assert.strictEqual(req.socket.listeners('error').length, 1) // node's original handler
+          assert.ok(err)
+          assert.ok(!res.headersSent)
+          assert.strictEqual(err.message, 'broken!')
           done();
         });
 
-        req.socket.emit('error', new Error('broken!'));
+        req.socket.destroy(new Error('broken!'))
       });
 
       request(app)

From 61f40491222dbede653b9938e6a4676f187aab44 Mon Sep 17 00:00:00 2001
From: Abhinav Das <theabhinavdas@gmail.com>
Date: Sat, 8 Oct 2022 00:32:42 +0530
Subject: [PATCH 373/479] docs: replace Freenode with Libera Chat

closes #5013
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 9b8bc34a0ce..0936816bedb 100644
--- a/Readme.md
+++ b/Readme.md
@@ -51,7 +51,7 @@ for more information.
 ## Docs & Community
 
   * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/expressjs/expressjs.com)]
-  * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
+  * [#express](https://web.libera.chat/#express) on [Libera Chat](https://libera.chat) IRC
   * [GitHub Organization](https://github.com/expressjs) for Official Middleware & Modules
   * Visit the [Wiki](https://github.com/expressjs/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion

From 8368dc178af16b91b576c4c1d135f701a0007e5d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 8 Oct 2022 16:11:42 -0400
Subject: [PATCH 374/479] 4.18.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index a05baee6179..e49870fed0b 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.18.2 / 2022-10-08
+===================
 
   * Fix regression routing a large stack in a single route
   * deps: body-parser@1.20.1
diff --git a/package.json b/package.json
index 6a11013c72c..0996637deaa 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.18.1",
+  "version": "4.18.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 06b2b1416d07698b8a6eed467f90d0b3ceb380c8 Mon Sep 17 00:00:00 2001
From: Kevin Jones <kevin@vcsjones.com>
Date: Mon, 31 Oct 2022 16:39:42 -0400
Subject: [PATCH 375/479] docs: update git clone to https protocol

closes #5032
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 0936816bedb..d0f3cf56e6d 100644
--- a/Readme.md
+++ b/Readme.md
@@ -104,7 +104,7 @@ $ npm start
   To view the examples, clone the Express repo and install the dependencies:
 
 ```console
-$ git clone git://github.com/expressjs/express.git --depth 1
+$ git clone https://github.com/expressjs/express.git --depth 1
 $ cd express
 $ npm install
 ```

From 29e117e676901a804031896f95f0eba317b05099 Mon Sep 17 00:00:00 2001
From: Arnaud Benhamdine <arnaud.benhamdine@gmail.com>
Date: Tue, 1 Nov 2022 22:34:11 +0100
Subject: [PATCH 376/479] build: Node.js@16.18

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd93ab223d2..33da666df3f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -100,7 +100,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.17"
+          node-version: "16.18"
 
         - name: Node.js 17.x
           node-version: "17.9"
diff --git a/appveyor.yml b/appveyor.yml
index 1fca21801e8..5c55ace4a05 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -17,7 +17,7 @@ environment:
     - nodejs_version: "13.14"
     - nodejs_version: "14.20"
     - nodejs_version: "15.14"
-    - nodejs_version: "16.17"
+    - nodejs_version: "16.18"
     - nodejs_version: "17.9"
     - nodejs_version: "18.10"
 cache:

From 723b67766fb864424a59ebe46b6516bb484f6a23 Mon Sep 17 00:00:00 2001
From: Arnaud Benhamdine <arnaud.benhamdine@gmail.com>
Date: Tue, 1 Nov 2022 22:34:11 +0100
Subject: [PATCH 377/479] build: Node.js@18.12

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 33da666df3f..868525a4b1b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -106,7 +106,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.10"
+          node-version: "18.12"
 
     steps:
     - uses: actions/checkout@v2
diff --git a/appveyor.yml b/appveyor.yml
index 5c55ace4a05..02a5c1169d5 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,7 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.18"
     - nodejs_version: "17.9"
-    - nodejs_version: "18.10"
+    - nodejs_version: "18.12"
 cache:
   - node_modules
 install:

From 442fd467992992558806da8da07e945838712587 Mon Sep 17 00:00:00 2001
From: Abdul Rauf <abdulraufmujahid@gmail.com>
Date: Wed, 19 Oct 2022 18:05:06 +0500
Subject: [PATCH 378/479] build: actions/checkout@v3

closes #5027
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 868525a4b1b..b6a2879603d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -109,7 +109,7 @@ jobs:
           node-version: "18.12"
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}

From c6ee8d6e7f11c3ac6bdda8e1bd4c1e38445f2d22 Mon Sep 17 00:00:00 2001
From: Rakesh Bisht <raks.bisht@gmail.com>
Date: Fri, 10 Feb 2023 11:50:16 +0530
Subject: [PATCH 379/479] lint: remove unused function arguments in tests

closes #5124
---
 test/Router.js     |  2 +-
 test/app.param.js  |  6 +++---
 test/app.router.js | 22 +++++++++++-----------
 test/res.format.js |  4 ++--
 4 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/test/Router.js b/test/Router.js
index 0d0502ab40d..620c60278a1 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -201,7 +201,7 @@ describe('Router', function(){
     it('should handle throwing inside routes with params', function(done) {
       var router = new Router();
 
-      router.get('/foo/:id', function(req, res, next){
+      router.get('/foo/:id', function () {
         throw new Error('foo');
       });
 
diff --git a/test/app.param.js b/test/app.param.js
index 8893851f9d5..b4ccc8a2d12 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -166,7 +166,7 @@ describe('app', function(){
       app.get('/:user', function(req, res, next) {
         next('route');
       });
-      app.get('/:user', function(req, res, next) {
+      app.get('/:user', function (req, res) {
         res.send(req.params.user);
       });
 
@@ -187,11 +187,11 @@ describe('app', function(){
         next(new Error('invalid invocation'))
       });
 
-      app.post('/:user', function(req, res, next) {
+      app.post('/:user', function (req, res) {
         res.send(req.params.user);
       });
 
-      app.get('/:thing', function(req, res, next) {
+      app.get('/:thing', function (req, res) {
         res.send(req.thing);
       });
 
diff --git a/test/app.router.js b/test/app.router.js
index 3069a22c772..4fde03105c6 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -90,7 +90,7 @@ describe('app.router', function(){
     it('should decode correct params', function(done){
       var app = express();
 
-      app.get('/:name', function(req, res, next){
+      app.get('/:name', function (req, res) {
         res.send(req.params.name);
       });
 
@@ -102,7 +102,7 @@ describe('app.router', function(){
     it('should not accept params in malformed paths', function(done) {
       var app = express();
 
-      app.get('/:name', function(req, res, next){
+      app.get('/:name', function (req, res) {
         res.send(req.params.name);
       });
 
@@ -114,7 +114,7 @@ describe('app.router', function(){
     it('should not decode spaces', function(done) {
       var app = express();
 
-      app.get('/:name', function(req, res, next){
+      app.get('/:name', function (req, res) {
         res.send(req.params.name);
       });
 
@@ -126,7 +126,7 @@ describe('app.router', function(){
     it('should work with unicode', function(done) {
       var app = express();
 
-      app.get('/:name', function(req, res, next){
+      app.get('/:name', function (req, res) {
         res.send(req.params.name);
       });
 
@@ -910,7 +910,7 @@ describe('app.router', function(){
         next();
       });
 
-      app.get('/bar', function(req, res){
+      app.get('/bar', function () {
         assert(0);
       });
 
@@ -919,7 +919,7 @@ describe('app.router', function(){
         next();
       });
 
-      app.get('/foo', function(req, res, next){
+      app.get('/foo', function (req, res) {
         calls.push('/foo 2');
         res.json(calls)
       });
@@ -939,7 +939,7 @@ describe('app.router', function(){
         next('route')
       }
 
-      app.get('/foo', fn, function(req, res, next){
+      app.get('/foo', fn, function (req, res) {
         res.end('failure')
       });
 
@@ -964,11 +964,11 @@ describe('app.router', function(){
         next('router')
       }
 
-      router.get('/foo', fn, function (req, res, next) {
+      router.get('/foo', fn, function (req, res) {
         res.end('failure')
       })
 
-      router.get('/foo', function (req, res, next) {
+      router.get('/foo', function (req, res) {
         res.end('failure')
       })
 
@@ -995,7 +995,7 @@ describe('app.router', function(){
         next();
       });
 
-      app.get('/bar', function(req, res){
+      app.get('/bar', function () {
         assert(0);
       });
 
@@ -1004,7 +1004,7 @@ describe('app.router', function(){
         next(new Error('fail'));
       });
 
-      app.get('/foo', function(req, res, next){
+      app.get('/foo', function () {
         assert(0);
       });
 
diff --git a/test/res.format.js b/test/res.format.js
index 45243d17a1b..cba6fe136b1 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -61,7 +61,7 @@ app3.use(function(req, res, next){
 
 var app4 = express();
 
-app4.get('/', function(req, res, next){
+app4.get('/', function (req, res) {
   res.format({
     text: function(){ res.send('hey') },
     html: function(){ res.send('<p>hey</p>') },
@@ -155,7 +155,7 @@ describe('res', function(){
       var app = express();
       var router = express.Router();
 
-      router.get('/', function(req, res, next){
+      router.get('/', function (req, res) {
         res.format({
           text: function(){ res.send('hey') },
           html: function(){ res.send('<p>hey</p>') },

From a1efd9d6cf968a9e863f3fdd3fef63d06ff039c4 Mon Sep 17 00:00:00 2001
From: Rakesh Bisht <raks.bisht@gmail.com>
Date: Wed, 8 Feb 2023 16:13:20 +0530
Subject: [PATCH 380/479] lint: remove unused parameter from internal function

coses #5119
---
 lib/utils.js | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/utils.js b/lib/utils.js
index 799a6a2b4ee..ab22f61e966 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -117,17 +117,15 @@ exports.contentDisposition = deprecate.function(contentDisposition,
 /**
  * Parse accept params `str` returning an
  * object with `.value`, `.quality` and `.params`.
- * also includes `.originalIndex` for stable sorting
  *
  * @param {String} str
- * @param {Number} index
  * @return {Object}
  * @api private
  */
 
-function acceptParams(str, index) {
+function acceptParams (str) {
   var parts = str.split(/ *; */);
-  var ret = { value: parts[0], quality: 1, params: {}, originalIndex: index };
+  var ret = { value: parts[0], quality: 1, params: {} }
 
   for (var i = 1; i < parts.length; ++i) {
     var pms = parts[i].split(/ *= */);

From 6b4c4f5426fb5de23fb7174fd6e3bf53048e06ca Mon Sep 17 00:00:00 2001
From: Rakesh Bisht <raks.bisht@gmail.com>
Date: Wed, 8 Feb 2023 15:56:13 +0530
Subject: [PATCH 381/479] docs: fix typos in JSDoc comments

closes #5117
---
 examples/markdown/index.js | 2 +-
 lib/router/index.js        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/markdown/index.js b/examples/markdown/index.js
index 74ac05e77f3..23d645e66b2 100644
--- a/examples/markdown/index.js
+++ b/examples/markdown/index.js
@@ -26,7 +26,7 @@ app.engine('md', function(path, options, fn){
 
 app.set('views', path.join(__dirname, 'views'));
 
-// make it the default so we dont need .md
+// make it the default, so we don't need .md
 app.set('view engine', 'md');
 
 app.get('/', function(req, res){
diff --git a/lib/router/index.js b/lib/router/index.js
index 5174c34f455..abb3a6f589e 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -36,7 +36,7 @@ var toString = Object.prototype.toString;
  * Initialize a new `Router` with the given `options`.
  *
  * @param {Object} [options]
- * @return {Router} which is an callable function
+ * @return {Router} which is a callable function
  * @public
  */
 

From 3c1d605da76a6c25dbe423a42d58871803c3e328 Mon Sep 17 00:00:00 2001
From: Rakesh Bisht <raks.bisht@gmail.com>
Date: Fri, 3 Feb 2023 20:34:39 +0530
Subject: [PATCH 382/479] lint: remove unused parameters in examples

closes #5113
---
 examples/error/index.js       | 2 +-
 examples/view-locals/index.js | 4 ++--
 examples/web-service/index.js | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/examples/error/index.js b/examples/error/index.js
index d922de06cc4..d733a81172d 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -26,7 +26,7 @@ function error(err, req, res, next) {
   res.send('Internal Server Error');
 }
 
-app.get('/', function(req, res){
+app.get('/', function () {
   // Caught and passed down to the errorHandler middleware
   throw new Error('something broke!');
 });
diff --git a/examples/view-locals/index.js b/examples/view-locals/index.js
index bf52d2a85ad..a2af24f3553 100644
--- a/examples/view-locals/index.js
+++ b/examples/view-locals/index.js
@@ -61,7 +61,7 @@ function users(req, res, next) {
   })
 }
 
-app.get('/middleware', count, users, function(req, res, next){
+app.get('/middleware', count, users, function (req, res) {
   res.render('index', {
     title: 'Users',
     count: req.count,
@@ -99,7 +99,7 @@ function users2(req, res, next) {
   })
 }
 
-app.get('/middleware-locals', count2, users2, function(req, res, next){
+app.get('/middleware-locals', count2, users2, function (req, res) {
   // you can see now how we have much less
   // to pass to res.render(). If we have
   // several routes related to users this
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index a2cd2cb7f90..d1a90362153 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -72,12 +72,12 @@ var userRepos = {
 // and simply expose the data
 
 // example: http://localhost:3000/api/users/?api-key=foo
-app.get('/api/users', function(req, res, next){
+app.get('/api/users', function (req, res) {
   res.send(users);
 });
 
 // example: http://localhost:3000/api/repos/?api-key=foo
-app.get('/api/repos', function(req, res, next){
+app.get('/api/repos', function (req, res) {
   res.send(repos);
 });
 

From f05b5d0e9c43625e5677b427c33b2f950eb5bea8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Feb 2023 11:59:40 -0500
Subject: [PATCH 383/479] build: Node.js@16.19

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b6a2879603d..332ce4394ca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -100,7 +100,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.18"
+          node-version: "16.19"
 
         - name: Node.js 17.x
           node-version: "17.9"
diff --git a/appveyor.yml b/appveyor.yml
index 02a5c1169d5..4c8722ed9f0 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -17,7 +17,7 @@ environment:
     - nodejs_version: "13.14"
     - nodejs_version: "14.20"
     - nodejs_version: "15.14"
-    - nodejs_version: "16.18"
+    - nodejs_version: "16.19"
     - nodejs_version: "17.9"
     - nodejs_version: "18.12"
 cache:

From 546969d1989d00fda460ccb23fabb943650dac51 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Feb 2023 12:07:48 -0500
Subject: [PATCH 384/479] build: Node.js@18.14

---
 .github/workflows/ci.yml | 8 ++++++--
 appveyor.yml             | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 332ce4394ca..64538c290c3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -106,7 +106,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.12"
+          node-version: "18.14"
 
     steps:
     - uses: actions/checkout@v3
@@ -120,7 +120,11 @@ jobs:
     - name: Configure npm
       run: |
         npm config set loglevel error
-        npm config set shrinkwrap false
+        if [[ "$(npm config get package-lock)" == "true" ]]; then
+          npm config set package-lock false
+        else
+          npm config set shrinkwrap false
+        fi
 
     - name: Install npm module(s) ${{ matrix.npm-i }}
       run: npm install --save-dev ${{ matrix.npm-i }}
diff --git a/appveyor.yml b/appveyor.yml
index 4c8722ed9f0..47941052bfb 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,7 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.19"
     - nodejs_version: "17.9"
-    - nodejs_version: "18.12"
+    - nodejs_version: "18.14"
 cache:
   - node_modules
 install:
@@ -30,7 +30,11 @@ install:
   # Configure npm
   - ps: |
       npm config set loglevel error
-      npm config set shrinkwrap false
+      if ((npm config get package-lock) -eq "true") {
+        npm config set package-lock false
+      } else {
+        npm config set shrinkwrap false
+      }
   # Remove all non-test dependencies
   - ps: |
       # Remove example dependencies

From b9f7a97fe164d2a64279105abe375c69eaab9ebb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Feb 2023 18:10:59 -0500
Subject: [PATCH 385/479] build: use $GITHUB_OUTPUT for environment list

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64538c290c3..a4bf538948f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -155,7 +155,7 @@ jobs:
         echo "node@$(node -v)"
         echo "npm@$(npm -v)"
         npm -s ls ||:
-        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print "::set-output name=" $2 "::" $3 }'
+        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print $2 "=" $3 }' >> "$GITHUB_OUTPUT"
 
     - name: Run tests
       shell: bash

From 506fbd63befe810783dba49d11159c7ad46c239a Mon Sep 17 00:00:00 2001
From: Rakesh Bisht <raks.bisht@gmail.com>
Date: Wed, 22 Feb 2023 18:30:50 +0530
Subject: [PATCH 386/479] docs: add missing JSDoc param for
 parseExtendedQueryString

closes #5130
---
 lib/utils.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/utils.js b/lib/utils.js
index ab22f61e966..56e12b9b541 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -280,6 +280,7 @@ function createETagGenerator (options) {
 /**
  * Parse an extended query string with qs.
  *
+ * @param {String} str
  * @return {Object}
  * @private
  */

From 1e42a98db6708e5a3609d0f7c09bcc176b481ea7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Feb 2023 00:24:20 -0500
Subject: [PATCH 387/479] deps: body-parser@1.20.2

---
 History.md           | 8 ++++++++
 package.json         | 2 +-
 test/express.json.js | 8 ++++----
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index e49870fed0b..7b0cc4abf78 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+unreleased
+==========
+
+  * deps: body-parser@1.20.2
+    - Fix strict json error message on Node.js 19+
+    - deps: content-type@~1.0.5
+    - deps: raw-body@2.5.2
+
 4.18.2 / 2022-10-08
 ===================
 
diff --git a/package.json b/package.json
index 0996637deaa..adf479dfce6 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
   "dependencies": {
     "accepts": "~1.3.8",
     "array-flatten": "1.1.1",
-    "body-parser": "1.20.1",
+    "body-parser": "1.20.2",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
     "cookie": "0.5.0",
diff --git a/test/express.json.js b/test/express.json.js
index a8cfebc41e2..f6f536b15e5 100644
--- a/test/express.json.js
+++ b/test/express.json.js
@@ -262,7 +262,7 @@ describe('express.json()', function () {
           .post('/')
           .set('Content-Type', 'application/json')
           .send('true')
-          .expect(400, '[entity.parse.failed] ' + parseError('#rue').replace('#', 't'), done)
+          .expect(400, '[entity.parse.failed] ' + parseError('#rue').replace(/#/g, 't'), done)
       })
     })
 
@@ -290,7 +290,7 @@ describe('express.json()', function () {
           .post('/')
           .set('Content-Type', 'application/json')
           .send('true')
-          .expect(400, '[entity.parse.failed] ' + parseError('#rue').replace('#', 't'), done)
+          .expect(400, '[entity.parse.failed] ' + parseError('#rue').replace(/#/g, 't'), done)
       })
 
       it('should not parse primitives with leading whitespaces', function (done) {
@@ -298,7 +298,7 @@ describe('express.json()', function () {
           .post('/')
           .set('Content-Type', 'application/json')
           .send('    true')
-          .expect(400, '[entity.parse.failed] ' + parseError('    #rue').replace('#', 't'), done)
+          .expect(400, '[entity.parse.failed] ' + parseError('    #rue').replace(/#/g, 't'), done)
       })
 
       it('should allow leading whitespaces in JSON', function (done) {
@@ -316,7 +316,7 @@ describe('express.json()', function () {
           .set('X-Error-Property', 'stack')
           .send('true')
           .expect(400)
-          .expect(shouldContainInBody(parseError('#rue').replace('#', 't')))
+          .expect(shouldContainInBody(parseError('#rue').replace(/#/g, 't')))
           .end(done)
       })
     })

From 60b7c672c19ba6b96cc7e5383eee00f8bf99a45a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Feb 2023 00:27:06 -0500
Subject: [PATCH 388/479] build: mocha@10.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index adf479dfce6..c3641a02c82 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "hbs": "4.2.0",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "10.0.0",
+    "mocha": "10.2.0",
     "morgan": "1.10.0",
     "multiparty": "4.2.3",
     "nyc": "15.1.0",

From 8a76f39d9844f36797cd794fb74b47c635798ae5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Feb 2023 00:28:41 -0500
Subject: [PATCH 389/479] build: eslint@8.34.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c3641a02c82..e4ed037cfa7 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "cookie-parser": "1.4.6",
     "cookie-session": "2.0.0",
     "ejs": "3.1.8",
-    "eslint": "8.24.0",
+    "eslint": "8.34.0",
     "express-session": "1.17.2",
     "hbs": "4.2.0",
     "marked": "0.7.0",

From 5ad95419bac1cb5bcc1f09fd1872f2b2af4aed1a Mon Sep 17 00:00:00 2001
From: Rakesh Bisht <raks.bisht@gmail.com>
Date: Thu, 23 Feb 2023 11:36:40 +0530
Subject: [PATCH 390/479] docs: fix typos in history

closes #5131
---
 History.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 7b0cc4abf78..17b03705df4 100644
--- a/History.md
+++ b/History.md
@@ -2119,7 +2119,7 @@ unreleased
  * deps: connect@2.21.0
    - deprecate `connect(middleware)` -- use `app.use(middleware)` instead
    - deprecate `connect.createServer()` -- use `connect()` instead
-   - fix `res.setHeader()` patch to work with with get -> append -> set pattern
+   - fix `res.setHeader()` patch to work with get -> append -> set pattern
    - deps: compression@~1.0.8
    - deps: errorhandler@~1.1.1
    - deps: express-session@~1.5.0
@@ -3330,8 +3330,8 @@ Shaw]
   * Added node v0.1.97 compatibility
   * Added support for deleting cookies via Request#cookie('key', null)
   * Updated haml submodule
-  * Fixed not-found page, now using using charset utf-8
-  * Fixed show-exceptions page, now using using charset utf-8
+  * Fixed not-found page, now using charset utf-8
+  * Fixed show-exceptions page, now using charset utf-8
   * Fixed view support due to fs.readFile Buffers
   * Changed; mime.type() no longer accepts ".type" due to node extname() changes
 
@@ -3366,7 +3366,7 @@ Shaw]
 ==================
 
   * Added charset support via Request#charset (automatically assigned to 'UTF-8' when respond()'s
-    encoding is set to 'utf8' or 'utf-8'.
+    encoding is set to 'utf8' or 'utf-8').
   * Added "encoding" option to Request#render(). Closes #299
   * Added "dump exceptions" setting, which is enabled by default.
   * Added simple ejs template engine support
@@ -3405,7 +3405,7 @@ Shaw]
   * Added [haml.js](http://github.com/visionmedia/haml.js) submodule; removed haml-js
   * Added callback function support to Request#halt() as 3rd/4th arg
   * Added preprocessing of route param wildcards using param(). Closes #251
-  * Added view partial support (with collections etc)
+  * Added view partial support (with collections etc.)
   * Fixed bug preventing falsey params (such as ?page=0). Closes #286
   * Fixed setting of multiple cookies. Closes #199
   * Changed; view naming convention is now NAME.TYPE.ENGINE (for example page.html.haml)

From 9bc1742937253825d2dc1e9a48c8e8424f0a315b Mon Sep 17 00:00:00 2001
From: Arnaud Benhamdine <arnaud.benhamdine@gmail.com>
Date: Thu, 23 Feb 2023 14:18:57 +0100
Subject: [PATCH 391/479] build: support Node.js 19.x

---
 .github/workflows/ci.yml | 4 ++++
 appveyor.yml             | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4bf538948f..c6fb81de93f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,6 +31,7 @@ jobs:
         - Node.js 16.x
         - Node.js 17.x
         - Node.js 18.x
+        - Node.js 19.x
 
         include:
         - name: Node.js 0.10
@@ -108,6 +109,9 @@ jobs:
         - name: Node.js 18.x
           node-version: "18.14"
 
+        - name: Node.js 19.x
+          node-version: "19.7"
+
     steps:
     - uses: actions/checkout@v3
 
diff --git a/appveyor.yml b/appveyor.yml
index 47941052bfb..ac671ef47bc 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -20,6 +20,7 @@ environment:
     - nodejs_version: "16.19"
     - nodejs_version: "17.9"
     - nodejs_version: "18.14"
+    - nodejs_version: "19.7"
 cache:
   - node_modules
 install:

From 74beeac0718c928b4ba249aba3652c52fbe32ca8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Feb 2023 17:23:22 -0500
Subject: [PATCH 392/479] Fix routing requests without method

---
 History.md          |  1 +
 lib/router/route.js |  9 +++++++--
 test/Router.js      | 27 +++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 17b03705df4..9e85df3ceb2 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix routing requests without method
   * deps: body-parser@1.20.2
     - Fix strict json error message on Node.js 19+
     - deps: content-type@~1.0.5
diff --git a/lib/router/route.js b/lib/router/route.js
index cc643ac8bdb..a65756d6de6 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -60,7 +60,10 @@ Route.prototype._handles_method = function _handles_method(method) {
     return true;
   }
 
-  var name = method.toLowerCase();
+  // normalize name
+  var name = typeof method === 'string'
+    ? method.toLowerCase()
+    : method
 
   if (name === 'head' && !this.methods['head']) {
     name = 'get';
@@ -103,8 +106,10 @@ Route.prototype.dispatch = function dispatch(req, res, done) {
   if (stack.length === 0) {
     return done();
   }
+  var method = typeof req.method === 'string'
+    ? req.method.toLowerCase()
+    : req.method
 
-  var method = req.method.toLowerCase();
   if (method === 'head' && !this.methods['head']) {
     method = 'get';
   }
diff --git a/test/Router.js b/test/Router.js
index 620c60278a1..cf5b5c1f0d3 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -61,6 +61,33 @@ describe('Router', function(){
     router.handle({ method: 'GET' }, {}, done)
   })
 
+  it('handle missing method', function (done) {
+    var all = false
+    var router = new Router()
+    var route = router.route('/foo')
+    var use = false
+
+    route.post(function (req, res, next) { next(new Error('should not run')) })
+    route.all(function (req, res, next) {
+      all = true
+      next()
+    })
+    route.get(function (req, res, next) { next(new Error('should not run')) })
+
+    router.get('/foo', function (req, res, next) { next(new Error('should not run')) })
+    router.use(function (req, res, next) {
+      use = true
+      next()
+    })
+
+    router.handle({ url: '/foo' }, {}, function (err) {
+      if (err) return done(err)
+      assert.ok(all)
+      assert.ok(use)
+      done()
+    })
+  })
+
   it('should not stack overflow with many registered routes', function(done){
     this.timeout(5000) // long-running test
 

From 0debedf4f31bb20203da0534719b9b10d6ac9a29 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Feb 2023 13:34:32 -0500
Subject: [PATCH 393/479] build: fix code coverage aggregate upload

---
 .github/workflows/ci.yml | 39 +++++++++++++++++++++++++++++++--------
 1 file changed, 31 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c6fb81de93f..b30c56c2f12 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -163,25 +163,48 @@ jobs:
 
     - name: Run tests
       shell: bash
-      run: npm run test-ci
+      run: |
+        npm run test-ci
+        cp coverage/lcov.info "coverage/${{ matrix.name }}.lcov"
 
     - name: Lint code
       if: steps.list_env.outputs.eslint != ''
       run: npm run lint
 
     - name: Collect code coverage
-      uses: coverallsapp/github-action@master
+      run: |
+        mv ./coverage "./${{ matrix.name }}"
+        mkdir ./coverage
+        mv "./${{ matrix.name }}" "./coverage/${{ matrix.name }}"
+
+    - name: Upload code coverage
+      uses: actions/upload-artifact@v3
       with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        flag-name: run-${{ matrix.test_number }}
-        parallel: true
+        name: coverage
+        path: ./coverage
+        retention-days: 1
 
   coverage:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - name: Upload code coverage
+    - uses: actions/checkout@v3
+
+    - name: Install lcov
+      shell: bash
+      run: sudo apt-get -y install lcov
+
+    - name: Collect coverage reports
+      uses: actions/download-artifact@v3
+      with:
+        name: coverage
+        path: ./coverage
+
+    - name: Merge coverage reports
+      shell: bash
+      run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
+
+    - name: Upload coverage report
       uses: coverallsapp/github-action@master
       with:
-        github-token: ${{ secrets.github_token }}
-        parallel-finished: true
+        github-token: ${{ secrets.GITHUB_TOKEN }}

From 8c24fa8f7b6d443869c655166c93869d8b299627 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Mar 2023 22:43:19 -0400
Subject: [PATCH 394/479] tests: wait for server close in app.listen()

---
 test/app.listen.js | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/test/app.listen.js b/test/app.listen.js
index 08eeaaa63c2..0eec582e69a 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -7,8 +7,7 @@ describe('app.listen()', function(){
     var app = express();
 
     var server = app.listen(9999, function(){
-      server.close();
-      done();
+      server.close(done)
     });
   })
 })

From f4e48bc43eece928f005a4458c87a16ce089e8e5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Mar 2023 22:49:54 -0400
Subject: [PATCH 395/479] build: ejs@3.1.9

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e4ed037cfa7..8a7548aff5d 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
     "connect-redis": "3.4.2",
     "cookie-parser": "1.4.6",
     "cookie-session": "2.0.0",
-    "ejs": "3.1.8",
+    "ejs": "3.1.9",
     "eslint": "8.34.0",
     "express-session": "1.17.2",
     "hbs": "4.2.0",

From b8b2eff3c3eac6a1df3919a87f7c7316d40ae97a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Mar 2023 22:52:34 -0400
Subject: [PATCH 396/479] build: eslint@8.36.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8a7548aff5d..b77937d439f 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "cookie-parser": "1.4.6",
     "cookie-session": "2.0.0",
     "ejs": "3.1.9",
-    "eslint": "8.34.0",
+    "eslint": "8.36.0",
     "express-session": "1.17.2",
     "hbs": "4.2.0",
     "marked": "0.7.0",

From f540c3b0195393974d4875a410f4c00a07a2ab60 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Mar 2023 22:59:15 -0400
Subject: [PATCH 397/479] build: Node.js@18.15

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b30c56c2f12..20c37976a43 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,7 +107,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.14"
+          node-version: "18.15"
 
         - name: Node.js 19.x
           node-version: "19.7"
diff --git a/appveyor.yml b/appveyor.yml
index ac671ef47bc..e9a6e6d57ef 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,7 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.19"
     - nodejs_version: "17.9"
-    - nodejs_version: "18.14"
+    - nodejs_version: "18.15"
     - nodejs_version: "19.7"
 cache:
   - node_modules

From 3531987844e533742f1159b0c3f1e07fad2e4597 Mon Sep 17 00:00:00 2001
From: Rakesh Bisht <raks.bisht@gmail.com>
Date: Sat, 4 Mar 2023 13:48:00 +0530
Subject: [PATCH 398/479] lint: remove unused function arguments in Route tests

closes #5137
---
 test/Route.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/Route.js b/test/Route.js
index 64dbad60ce9..2a37b9a4839 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -124,7 +124,7 @@ describe('Route', function(){
       var req = { method: 'POST', url: '/' };
       var route = new Route('');
 
-      route.get(function(req, res, next) {
+      route.get(function () {
         throw new Error('not me!');
       })
 
@@ -198,7 +198,7 @@ describe('Route', function(){
       var req = { order: '', method: 'GET', url: '/' };
       var route = new Route('');
 
-      route.all(function(req, res, next){
+      route.all(function () {
         throw new Error('foobar');
       });
 
@@ -224,7 +224,7 @@ describe('Route', function(){
       var req = { method: 'GET', url: '/' };
       var route = new Route('');
 
-      route.get(function(req, res, next){
+      route.get(function () {
         throw new Error('boom!');
       });
 

From 91b6fb83b4cf30ec626c0582f0b3a0a98d8afcb4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 6 Apr 2023 20:40:27 -0400
Subject: [PATCH 399/479] build: use nyc@14.1.1 for Node.js < 10

---
 .github/workflows/ci.yml | 4 ++--
 appveyor.yml             | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 20c37976a43..856c6314e8b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,11 +72,11 @@ jobs:
 
         - name: Node.js 8.x
           node-version: "8.17"
-          npm-i: mocha@7.2.0
+          npm-i: mocha@7.2.0 nyc@14.1.1
 
         - name: Node.js 9.x
           node-version: "9.11"
-          npm-i: mocha@7.2.0
+          npm-i: mocha@7.2.0 nyc@14.1.1
 
         - name: Node.js 10.x
           node-version: "10.24"
diff --git a/appveyor.yml b/appveyor.yml
index e9a6e6d57ef..88e81dfeee4 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -70,12 +70,12 @@ install:
       # nyc for test coverage
       # - use 10.3.2 for Node.js < 4
       # - use 11.9.0 for Node.js < 6
-      # - use 14.1.1 for Node.js < 8
+      # - use 14.1.1 for Node.js < 10
       if ([int]$env:nodejs_version.split(".")[0] -lt 4) {
         npm install --silent --save-dev nyc@10.3.2
       } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
         npm install --silent --save-dev nyc@11.9.0
-      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 8) {
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 10) {
         npm install --silent --save-dev nyc@14.1.1
       }
   - ps: |

From 24e4a2570d15d6cca53023410f754929c5391c6f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 6 Apr 2023 20:43:53 -0400
Subject: [PATCH 400/479] build: Node.js@16.20

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 856c6314e8b..30767d98962 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.19"
+          node-version: "16.20"
 
         - name: Node.js 17.x
           node-version: "17.9"
diff --git a/appveyor.yml b/appveyor.yml
index 88e81dfeee4..1412811ff46 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -17,7 +17,7 @@ environment:
     - nodejs_version: "13.14"
     - nodejs_version: "14.20"
     - nodejs_version: "15.14"
-    - nodejs_version: "16.19"
+    - nodejs_version: "16.20"
     - nodejs_version: "17.9"
     - nodejs_version: "18.15"
     - nodejs_version: "19.7"

From 2a00da2067b7017f769c9100205a2a5f267a884b Mon Sep 17 00:00:00 2001
From: Raz Luvaton <16746759+rluvaton@users.noreply.github.com>
Date: Tue, 11 Apr 2023 15:31:47 +0300
Subject: [PATCH 401/479] tests: use random port in listen test

closes #5162
---
 test/app.listen.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/app.listen.js b/test/app.listen.js
index 0eec582e69a..5b150063b9e 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -6,7 +6,7 @@ describe('app.listen()', function(){
   it('should wrap with an HTTP server', function(done){
     var app = express();
 
-    var server = app.listen(9999, function(){
+    var server = app.listen(0, function () {
       server.close(done)
     });
   })

From 13df1de857688057f3c7e6d315321b19f8e4259e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Aug 2023 19:49:36 -0400
Subject: [PATCH 402/479] build: eslint@8.47.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b77937d439f..fdf81725b4f 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "cookie-parser": "1.4.6",
     "cookie-session": "2.0.0",
     "ejs": "3.1.9",
-    "eslint": "8.36.0",
+    "eslint": "8.47.0",
     "express-session": "1.17.2",
     "hbs": "4.2.0",
     "marked": "0.7.0",

From 8d8bfaac7be5d06c0a8fcc069b1ee5b0ec398cd9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Aug 2023 19:58:41 -0400
Subject: [PATCH 403/479] build: Node.js@18.17

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30767d98962..3d14976a9b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,7 +107,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.15"
+          node-version: "18.17"
 
         - name: Node.js 19.x
           node-version: "19.7"
diff --git a/appveyor.yml b/appveyor.yml
index 1412811ff46..63adc423c8f 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,7 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.20"
     - nodejs_version: "17.9"
-    - nodejs_version: "18.15"
+    - nodejs_version: "18.17"
     - nodejs_version: "19.7"
 cache:
   - node_modules

From 02d1c3916ebaec776b4d754be54aa1500e2e9563 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Aug 2023 20:07:50 -0400
Subject: [PATCH 404/479] build: Node.js@19.9

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3d14976a9b2..35017785332 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,7 +110,7 @@ jobs:
           node-version: "18.17"
 
         - name: Node.js 19.x
-          node-version: "19.7"
+          node-version: "19.9"
 
     steps:
     - uses: actions/checkout@v3
diff --git a/appveyor.yml b/appveyor.yml
index 63adc423c8f..44af842e858 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -20,7 +20,7 @@ environment:
     - nodejs_version: "16.20"
     - nodejs_version: "17.9"
     - nodejs_version: "18.17"
-    - nodejs_version: "19.7"
+    - nodejs_version: "19.9"
 cache:
   - node_modules
 install:

From a22920707bfd30e083e5b8e076841d226266cb06 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Nov 2023 22:08:37 -0400
Subject: [PATCH 405/479] build: actions/checkout@v4

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 35017785332..b545e8bd0d1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -113,7 +113,7 @@ jobs:
           node-version: "19.9"
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -188,7 +188,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Install lcov
       shell: bash

From c4fe7de7bcb7ce241dfa7137fad96d48b75e86f3 Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Fri, 16 Feb 2024 08:52:09 -0600
Subject: [PATCH 406/479] docs: update TC governance rules

closes #5483
---
 Contributing.md | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 485dee597e1..89f92806328 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -107,7 +107,22 @@ move forward towards a consensus. It is not expected that a meeting of the TC
 will resolve all issues on its agenda during that meeting and may prefer to continue
 the discussion happening among the committers.
 
-Members can be added to the TC at any time. Any committer can nominate another committer
+Members can be added to the TC at any time. Any TC member can nominate another committer
 to the TC and the TC uses its standard consensus seeking process to evaluate whether or
-not to add this new member. Members who do not participate consistently at the level of
-a majority of the other members are expected to resign.
+not to add this new member. The TC will consist of a minimum of 3 active members and a
+maximum of 10. If the TC should drop below 5 members the active TC members should nominate
+someone new. If a TC member is stepping down, they are encouraged (but not required) to
+nominate someone to take their place.
+
+TC members will be added as admin's on the Github orgs, npm orgs, and other resources as
+necessary to be effective in the role.
+
+To remain "active" a TC member should have participation within the last 6 months and miss
+no more than three consecutive TC meetings. Members who do not meet this are expected to step down.
+If A TC member does not step down, an issue can be opened in the discussions repo to move them
+to inactive status. TC members who step down or are removed due to inactivity will be moved
+into inactive status.
+
+Inactive status members can become active members by self nomination if the TC is not already
+larger than the maximum of 10. They will also be given preference if, while at max size, an
+active member steps down.

From 59aae7686b995186a71da48abd4af5be72ff4ef5 Mon Sep 17 00:00:00 2001
From: Gireesh Punathil <gpunathi@in.ibm.com>
Date: Mon, 9 Mar 2020 14:12:29 +0530
Subject: [PATCH 407/479] docs: add project captains to contribution

closes #4210
closes #5484
---
 Contributing.md | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 89f92806328..dfe5f13833b 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -12,6 +12,7 @@ contributors can be involved in decision making.
 
 * A **Contributor** is any individual creating or commenting on an issue or pull request.
 * A **Committer** is a subset of contributors who have been given write access to the repository.
+* A **Project Captain** is the lead maintainer of a repository.
 * A **TC (Technical Committee)** is a group of committers representing the required technical
 expertise to resolve rare disputes.
 * A **Triager** is a subset of contributors who have been given triage access to the repository.
@@ -102,10 +103,10 @@ If a consensus cannot be reached that has no objections then a majority wins vot
 is called. It is also expected that the majority of decisions made by the TC are via
 a consensus seeking process and that voting is only used as a last-resort.
 
-Resolution may involve returning the issue to committers with suggestions on how to
-move forward towards a consensus. It is not expected that a meeting of the TC
+Resolution may involve returning the issue to project captains with suggestions on
+how to move forward towards a consensus. It is not expected that a meeting of the TC
 will resolve all issues on its agenda during that meeting and may prefer to continue
-the discussion happening among the committers.
+the discussion happening among the project captains.
 
 Members can be added to the TC at any time. Any TC member can nominate another committer
 to the TC and the TC uses its standard consensus seeking process to evaluate whether or
@@ -126,3 +127,34 @@ into inactive status.
 Inactive status members can become active members by self nomination if the TC is not already
 larger than the maximum of 10. They will also be given preference if, while at max size, an
 active member steps down.
+
+## Project Captains
+
+The Express TC can designate captains for individual projects/repos in the
+organizations. These captains are responsible for being the primary
+day-to-day maintainers of the repo on a technical and community front.
+Repo captains are empowered with repo ownership and package publication rights.
+When there are conflicts, especially on topics that effect the Express project
+at large, captains are responsible to raise it up to the TC and drive
+those conflicts to resolution. Captains are also responsible for making sure
+community members follow the community guidelines, maintaining the repo
+and the published package, as well as in providing user support.
+
+Like TC members, Repo captains are a subset of committers.
+
+To become a captain for a project the candidate is expected to participate in that
+project for at least 6 months as a committer prior to the request. They should have
+helped with code contributions as well as triaging issues. They are also required to
+have 2FA enabled on both their GitHub and npm accounts. Any TC member or existing
+captain on the repo can nominate another committer to the captain role, submit a PR to
+this doc, under `Current Project Captains` section (maintaining the sort order) with
+the project, their GitHub handle and npm username (if different). The PR will require
+at least 2 approvals from TC members and 2 weeks hold time to allow for comment and/or
+dissent.  When the PR is merged, a TC member will add them to the proper GitHub/npm groups.
+
+### Current Project Captains
+
+- `expressjs.com`: @crandmck
+- `multer`: @LinusU
+- `path-to-regexp`: @blakeembrey
+- `router`: @dougwilson

From 2a89eb5c749a168820d6ea96723ad8a7e979a58b Mon Sep 17 00:00:00 2001
From: christof louw <louw.christof@gmail.com>
Date: Thu, 27 Jul 2023 11:06:18 +0200
Subject: [PATCH 408/479] tests: fix handling multiple callbacks

closes #5233
---
 test/Router.js     | 6 +++---
 test/app.router.js | 2 +-
 test/app.use.js    | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/test/Router.js b/test/Router.js
index cf5b5c1f0d3..b22001a9ff2 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -606,8 +606,8 @@ describe('Router', function(){
       var req2 = { url: '/foo/10/bar', method: 'get' };
       var router = new Router();
       var sub = new Router();
+      var cb = after(2, done)
 
-      done = after(2, done);
 
       sub.get('/bar', function(req, res, next) {
         next();
@@ -626,14 +626,14 @@ describe('Router', function(){
         assert.ifError(err);
         assert.equal(req1.ms, 50);
         assert.equal(req1.originalUrl, '/foo/50/bar');
-        done();
+        cb()
       });
 
       router.handle(req2, {}, function(err) {
         assert.ifError(err);
         assert.equal(req2.ms, 10);
         assert.equal(req2.originalUrl, '/foo/10/bar');
-        done();
+        cb()
       });
     });
   });
diff --git a/test/app.router.js b/test/app.router.js
index 4fde03105c6..12b6c1fa519 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -896,7 +896,7 @@ describe('app.router', function(){
 
       request(app)
         .get('/foo.json')
-        .expect(200, 'foo as json', done)
+        .expect(200, 'foo as json', cb)
     })
   })
 
diff --git a/test/app.use.js b/test/app.use.js
index fd9b1751a31..1de3275c8e2 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -57,7 +57,7 @@ describe('app', function(){
 
       request(app)
         .get('/forum')
-        .expect(200, 'forum', done)
+        .expect(200, 'forum', cb)
     })
 
     it('should set the child\'s .parent', function(){

From 3abea7f8189c73f7f219d8878343d961eb9a4910 Mon Sep 17 00:00:00 2001
From: riddlew <riddle.w@gmail.com>
Date: Thu, 18 May 2023 09:26:47 -0400
Subject: [PATCH 409/479] examples: remove multipart example

Closes #5193
closes #5195
---
 examples/README.md          |  1 -
 examples/multipart/index.js | 62 -------------------------------------
 package.json                |  1 -
 3 files changed, 64 deletions(-)
 delete mode 100644 examples/multipart/index.js

diff --git a/examples/README.md b/examples/README.md
index c19ed30a25c..bd1f1f6310f 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -13,7 +13,6 @@ This page contains list of examples using Express.
 - [hello-world](./hello-world) - Simple request handler
 - [markdown](./markdown) - Markdown as template engine
 - [multi-router](./multi-router) - Working with multiple Express routers
-- [multipart](./multipart) - Accepting multipart-encoded forms
 - [mvc](./mvc) - MVC-style controllers
 - [online](./online) - Tracking online user activity with `online` and `redis` packages
 - [params](./params) - Working with route parameters
diff --git a/examples/multipart/index.js b/examples/multipart/index.js
deleted file mode 100644
index ea7b86e0c94..00000000000
--- a/examples/multipart/index.js
+++ /dev/null
@@ -1,62 +0,0 @@
-'use strict'
-
-/**
- * Module dependencies.
- */
-
-var express = require('../..');
-var multiparty = require('multiparty');
-var format = require('util').format;
-
-var app = module.exports = express();
-
-app.get('/', function(req, res){
-  res.send('<form method="post" enctype="multipart/form-data">'
-    + '<p>Title: <input type="text" name="title" /></p>'
-    + '<p>Image: <input type="file" name="image" /></p>'
-    + '<p><input type="submit" value="Upload" /></p>'
-    + '</form>');
-});
-
-app.post('/', function(req, res, next){
-  // create a form to begin parsing
-  var form = new multiparty.Form();
-  var image;
-  var title;
-
-  form.on('error', next);
-  form.on('close', function(){
-    res.send(format('\nuploaded %s (%d Kb) as %s'
-      , image.filename
-      , image.size / 1024 | 0
-      , title));
-  });
-
-  // listen on field event for title
-  form.on('field', function(name, val){
-    if (name !== 'title') return;
-    title = val;
-  });
-
-  // listen on part event for image file
-  form.on('part', function(part){
-    if (!part.filename) return;
-    if (part.name !== 'image') return part.resume();
-    image = {};
-    image.filename = part.filename;
-    image.size = 0;
-    part.on('data', function(buf){
-      image.size += buf.length;
-    });
-  });
-
-
-  // parse the form
-  form.parse(req);
-});
-
-/* istanbul ignore next */
-if (!module.parent) {
-  app.listen(4000);
-  console.log('Express started on port 4000');
-}
diff --git a/package.json b/package.json
index fdf81725b4f..cf367736434 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,6 @@
     "method-override": "3.0.0",
     "mocha": "10.2.0",
     "morgan": "1.10.0",
-    "multiparty": "4.2.3",
     "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
     "supertest": "6.3.0",

From e720c5a21bfed5a9c73b2407797023bacad6980e Mon Sep 17 00:00:00 2001
From: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Date: Sat, 11 Nov 2023 20:02:47 +0100
Subject: [PATCH 410/479] docs: add documentation for benchmarks

closes #5312
---
 benchmarks/README.md | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 benchmarks/README.md

diff --git a/benchmarks/README.md b/benchmarks/README.md
new file mode 100644
index 00000000000..1894c527d63
--- /dev/null
+++ b/benchmarks/README.md
@@ -0,0 +1,34 @@
+# Express Benchmarks
+
+## Installation
+
+You will need to install [wrk](https://github.com/wg/wrk/blob/master/INSTALL) in order to run the benchmarks.
+
+## Running
+
+To run the benchmarks, first install the dependencies `npm i`, then run `make`
+
+The output will look something like this:
+
+```
+  50 connections
+  1 middleware
+ 7.15ms
+ 6784.01
+
+ [...redacted...]
+
+  1000 connections
+  10 middleware
+ 139.21ms
+ 6155.19
+
+```
+
+### Tip: Include Node.js version in output
+
+You can use `make && node -v` to include the node.js version in the output.
+
+### Tip: Save the results to a file
+
+You can use `make > results.log` to save the results to a file `results.log`.

From 59af63ac2e6aea6a9cefb6fe27705ccf024d8373 Mon Sep 17 00:00:00 2001
From: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Date: Sat, 17 Feb 2024 18:26:40 +0100
Subject: [PATCH 411/479] build: Node.js@18.19

closes #5490
---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b545e8bd0d1..5bef1f67edf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,7 +107,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.17"
+          node-version: "18.19"
 
         - name: Node.js 19.x
           node-version: "19.9"
diff --git a/appveyor.yml b/appveyor.yml
index 44af842e858..b865082930f 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -19,7 +19,7 @@ environment:
     - nodejs_version: "15.14"
     - nodejs_version: "16.20"
     - nodejs_version: "17.9"
-    - nodejs_version: "18.17"
+    - nodejs_version: "18.19"
     - nodejs_version: "19.9"
 cache:
   - node_modules

From 0e3ab6ec215fc297473323fb1e8d0df03033e774 Mon Sep 17 00:00:00 2001
From: Dmitry Kondar <dmitry.kondar@speedandfunction.com>
Date: Sat, 27 Jan 2024 20:29:09 +0200
Subject: [PATCH 412/479] examples: improve view count in cookie-sessions

closes #5414
---
 examples/cookie-sessions/index.js | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index 01c731c1c8f..83b6faee82b 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -13,13 +13,10 @@ var app = module.exports = express();
 app.use(cookieSession({ secret: 'manny is cool' }));
 
 // do something with the session
-app.use(count);
-
-// custom middleware
-function count(req, res) {
+app.get('/', function (req, res) {
   req.session.count = (req.session.count || 0) + 1
   res.send('viewed ' + req.session.count + ' times\n')
-}
+})
 
 /* istanbul ignore next */
 if (!module.parent) {

From 734b28190085c052e3ecd9c7d0b9595d9edb1b85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Fri, 2 Feb 2024 15:35:20 +0100
Subject: [PATCH 413/479] build: support Node.js 20.x

---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5bef1f67edf..df123370d9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,7 @@ jobs:
         - Node.js 17.x
         - Node.js 18.x
         - Node.js 19.x
+        - Node.js 20.x
 
         include:
         - name: Node.js 0.10
@@ -112,6 +113,8 @@ jobs:
         - name: Node.js 19.x
           node-version: "19.9"
 
+        - name: Node.js 20.x
+          node-version: "20.11"
     steps:
     - uses: actions/checkout@v4
 

From fdeb1d3176d11506557388ecaa2fe6a250e17efc Mon Sep 17 00:00:00 2001
From: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Date: Fri, 2 Feb 2024 16:31:12 +0100
Subject: [PATCH 414/479] build: support Node.js 20.x in appveyor

closes #5429
---
 appveyor.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/appveyor.yml b/appveyor.yml
index b865082930f..cb3e835a89e 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -21,6 +21,7 @@ environment:
     - nodejs_version: "17.9"
     - nodejs_version: "18.19"
     - nodejs_version: "19.9"
+    - nodejs_version: "20.11"
 cache:
   - node_modules
 install:

From c259c3407f8c503c83d95fb1f30b132b73bb6388 Mon Sep 17 00:00:00 2001
From: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Date: Fri, 2 Feb 2024 15:38:07 +0100
Subject: [PATCH 415/479] build: support Node.js 21.x

---
 .github/workflows/ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df123370d9e..e880f74dab6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,7 @@ jobs:
         - Node.js 18.x
         - Node.js 19.x
         - Node.js 20.x
+        - Node.js 21.x
 
         include:
         - name: Node.js 0.10
@@ -115,6 +116,10 @@ jobs:
 
         - name: Node.js 20.x
           node-version: "20.11"
+
+        - name: Node.js 21.x
+          node-version: "21.6.1"
+
     steps:
     - uses: actions/checkout@v4
 

From b9fea1224516e372f6f63480cc1830e5f6ee63e6 Mon Sep 17 00:00:00 2001
From: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Date: Fri, 2 Feb 2024 16:31:54 +0100
Subject: [PATCH 416/479] build: support Node.js 21.x in appveyor

---
 appveyor.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/appveyor.yml b/appveyor.yml
index cb3e835a89e..5c01a8d02ad 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -22,6 +22,7 @@ environment:
     - nodejs_version: "18.19"
     - nodejs_version: "19.9"
     - nodejs_version: "20.11"
+    - nodejs_version: "21.6.1"
 cache:
   - node_modules
 install:

From 23b44b3ddd45bc68487cc34cd576b117ba9d2609 Mon Sep 17 00:00:00 2001
From: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Date: Sat, 17 Feb 2024 18:23:09 +0100
Subject: [PATCH 417/479] build: support Node.js 21.6.2

---
 .github/workflows/ci.yml | 2 +-
 appveyor.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e880f74dab6..aa231b74d24 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -118,7 +118,7 @@ jobs:
           node-version: "20.11"
 
         - name: Node.js 21.x
-          node-version: "21.6.1"
+          node-version: "21.6.2"
 
     steps:
     - uses: actions/checkout@v4
diff --git a/appveyor.yml b/appveyor.yml
index 5c01a8d02ad..8ece802a7fc 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -22,7 +22,7 @@ environment:
     - nodejs_version: "18.19"
     - nodejs_version: "19.9"
     - nodejs_version: "20.11"
-    - nodejs_version: "21.6.1"
+    - nodejs_version: "21.6.2"
 cache:
   - node_modules
 install:

From e3eca805847e0057ab1c83e7d61a6cc1c1ca47f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Tue, 20 Feb 2024 08:44:27 +0100
Subject: [PATCH 418/479] build: pin Node 21.x to minor

Co-authored-by: Aravind Nair <22199259+aravindvnair99@users.noreply.github.com>
---
 appveyor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/appveyor.yml b/appveyor.yml
index 8ece802a7fc..ce26523b3aa 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -22,7 +22,7 @@ environment:
     - nodejs_version: "18.19"
     - nodejs_version: "19.9"
     - nodejs_version: "20.11"
-    - nodejs_version: "21.6.2"
+    - nodejs_version: "21.6"
 cache:
   - node_modules
 install:

From b625132864ef40b1fb119ff7c7b984573a7974c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Tue, 20 Feb 2024 08:44:34 +0100
Subject: [PATCH 419/479] build: pin Node 21.x to minor

Co-authored-by: Aravind Nair <22199259+aravindvnair99@users.noreply.github.com>
closes #5430
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aa231b74d24..01c82f81960 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -118,7 +118,7 @@ jobs:
           node-version: "20.11"
 
         - name: Node.js 21.x
-          node-version: "21.6.2"
+          node-version: "21.6"
 
     steps:
     - uses: actions/checkout@v4

From 1b51edac7c5f2844e23602164a52643bb625993a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Mon, 26 Feb 2024 20:20:53 +0100
Subject: [PATCH 420/479] 4.18.3

---
 History.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 9e85df3ceb2..07840455573 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,4 @@
-unreleased
+4.18.3 / 2024-02-26
 ==========
 
   * Fix routing requests without method
diff --git a/package.json b/package.json
index cf367736434..c3845d2d4bf 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.18.2",
+  "version": "4.18.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 06c6b88808f6d836afc58296812235a96d708b33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Sun, 10 Mar 2024 20:04:02 +0100
Subject: [PATCH 421/479] docs: update release date

---
 History.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 07840455573..b674cab4b0a 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,4 @@
-4.18.3 / 2024-02-26
+4.18.3 / 2024-02-29
 ==========
 
   * Fix routing requests without method

From 414854b82ea4312f50641ddf7668c9194c3c209c Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Thu, 29 Feb 2024 08:49:34 -0600
Subject: [PATCH 422/479] docs: nominating @wesleytodd to be project captian

---
 Contributing.md | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index dfe5f13833b..7311454dd89 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -154,7 +154,21 @@ dissent.  When the PR is merged, a TC member will add them to the proper GitHub/
 
 ### Current Project Captains
 
-- `expressjs.com`: @crandmck
-- `multer`: @LinusU
-- `path-to-regexp`: @blakeembrey
-- `router`: @dougwilson
+- `expressjs/express`: @wesleytodd
+- `expressjs/discussions`: @wesleytodd
+- `expressjs/expressjs.com`: @crandmck
+- `expressjs/body-parser`: @wesleytodd
+- `expressjs/multer`: @LinusU
+- `expressjs/cookie-parser`: @wesleytodd
+- `expressjs/generator`: @wesleytodd
+- `expressjs/statusboard`: @wesleytodd
+- `pillarjs/path-to-regexp`: @blakeembrey
+- `pillarjs/router`: @dougwilson, @wesleytodd
+- `pillarjs/finalhandler`: @wesleytodd
+- `pillarjs/request`: @wesleytodd
+- `jshttp/http-errors`: @wesleytodd
+- `jshttp/cookie`: @wesleytodd
+- `jshttp/on-finished`: @wesleytodd
+- `jshttp/forwarded`: @wesleytodd
+- `jshttp/proxy-addr`: @wesleytodd
+

From 4ee853e837dcc6c6c9f93c52278abe775c717fa1 Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Wed, 28 Feb 2024 14:49:11 -0600
Subject: [PATCH 423/479] docs: loosen TC activity rules

---
 Contributing.md | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 7311454dd89..a9ba84690cb 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -118,11 +118,13 @@ nominate someone to take their place.
 TC members will be added as admin's on the Github orgs, npm orgs, and other resources as
 necessary to be effective in the role.
 
-To remain "active" a TC member should have participation within the last 6 months and miss
-no more than three consecutive TC meetings. Members who do not meet this are expected to step down.
-If A TC member does not step down, an issue can be opened in the discussions repo to move them
-to inactive status. TC members who step down or are removed due to inactivity will be moved
-into inactive status.
+To remain "active" a TC member should have participation within the last 12 months and miss
+no more than six consecutive TC meetings. Our goal is to increase participation, not punish
+people for any lack of participation, this guideline should be only be used as such
+(replace an inactive member with a new active one, for example). Members who do not meet this
+are expected to step down. If A TC member does not step down, an issue can be opened in the
+discussions repo to move them to inactive status. TC members who step down or are removed due
+to inactivity will be moved into inactive status.
 
 Inactive status members can become active members by self nomination if the TC is not already
 larger than the maximum of 10. They will also be given preference if, while at max size, an

From 69a4cf2819c4449ec6ea45649691fb43a528d5d1 Mon Sep 17 00:00:00 2001
From: Rich Hodgkins <rich@bookcreator.com>
Date: Thu, 11 Jan 2024 11:36:11 +0000
Subject: [PATCH 424/479] deps: cookie@0.6.0

closes #5404
---
 History.md         |  7 +++++++
 package.json       |  2 +-
 test/res.cookie.js | 16 ++++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b674cab4b0a..0559bb012c5 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: cookie@0.6.0
+
 4.18.3 / 2024-02-29
 ==========
 
@@ -6,6 +11,8 @@
     - Fix strict json error message on Node.js 19+
     - deps: content-type@~1.0.5
     - deps: raw-body@2.5.2
+  * deps: cookie@0.6.0
+    - Add `partitioned` option
 
 4.18.2 / 2022-10-08
 ===================
diff --git a/package.json b/package.json
index c3845d2d4bf..990e98dc1aa 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "body-parser": "1.20.2",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
-    "cookie": "0.5.0",
+    "cookie": "0.6.0",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "2.0.0",
diff --git a/test/res.cookie.js b/test/res.cookie.js
index 93deb769887..c837820605c 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -82,6 +82,22 @@ describe('res', function(){
       })
     })
 
+    describe('partitioned', function () {
+      it('should set partitioned', function (done) {
+        var app = express();
+
+        app.use(function (req, res) {
+          res.cookie('name', 'tobi', { partitioned: true });
+          res.end();
+        });
+
+        request(app)
+          .get('/')
+          .expect('Set-Cookie', 'name=tobi; Path=/; Partitioned')
+          .expect(200, done)
+      })
+    })
+
     describe('maxAge', function(){
       it('should set relative expires', function(done){
         var app = express();

From 567c9c665d0de4c344b8e160146050770233783c Mon Sep 17 00:00:00 2001
From: Rand McKinney <crandmck@yahoo.com>
Date: Sat, 16 Mar 2024 11:57:42 -0600
Subject: [PATCH 425/479] Add note on how to update docs for new release
 (#5541)

* Update Release-Process.md

Add note about updating docs.

* Update Release-Process.md

* Update Release-Process.md
---
 Release-Process.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Release-Process.md b/Release-Process.md
index ae740972f77..55e62189250 100644
--- a/Release-Process.md
+++ b/Release-Process.md
@@ -184,3 +184,9 @@ $ npm publish
 
 **NOTE:** The version number to publish will be picked up automatically from
           package.json.
+          
+### Step 7. Update documentation website
+
+The documentation website https://expressjs.com/ documents the current release version in various places.  For a new release:
+1. Change the value of `current_version` in https://github.com/expressjs/expressjs.com/blob/gh-pages/_data/express.yml to match the latest version number.
+2. Add a new section to the change log.  For example, for a 4.x release, https://github.com/expressjs/expressjs.com/blob/gh-pages/en/changelog/4x.md,

From 0867302ddbde0e9463d0564fea5861feb708c2dd Mon Sep 17 00:00:00 2001
From: FDrag0n <34733637+FDrag0n@users.noreply.github.com>
Date: Fri, 15 Mar 2024 15:49:01 +0800
Subject: [PATCH 426/479] Prevent open redirect allow list bypass due to
 encodeurl

Co-authored-by: Jon Church <me@jonchurch.com>
---
 lib/response.js      | 20 ++++++++++++++++++-
 test/res.location.js | 46 +++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index fede486c06d..f7c94d10e78 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -34,6 +34,7 @@ var extname = path.extname;
 var mime = send.mime;
 var resolve = path.resolve;
 var vary = require('vary');
+var urlParse = require('url').parse;
 
 /**
  * Response prototype.
@@ -911,8 +912,25 @@ res.location = function location(url) {
     loc = this.req.get('Referrer') || '/';
   }
 
+  var lowerLoc = loc.toLowerCase();
+  var encodedUrl = encodeUrl(loc);
+  if (lowerLoc.indexOf('https://') === 0 || lowerLoc.indexOf('http://') === 0) {
+    try {
+      var parsedUrl = urlParse(loc);
+      var parsedEncodedUrl = urlParse(encodedUrl);
+      // Because this can encode the host, check that we did not change the host
+      if (parsedUrl.host !== parsedEncodedUrl.host) {
+        // If the host changes after encodeUrl, return the original url
+        return this.set('Location', loc);
+      }
+    } catch (e) {
+      // If parse fails, return the original url
+      return this.set('Location', loc);
+    }
+  }
+
   // set location
-  return this.set('Location', encodeUrl(loc));
+  return this.set('Location', encodedUrl);
 };
 
 /**
diff --git a/test/res.location.js b/test/res.location.js
index 158afac01e7..38cab027a83 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -1,13 +1,27 @@
 'use strict'
 
 var express = require('../')
-  , request = require('supertest');
+  , request = require('supertest')
+  , url = require('url');
 
 describe('res', function(){
   describe('.location(url)', function(){
     it('should set the header', function(done){
       var app = express();
 
+      app.use(function(req, res){
+        res.location('http://google.com/').end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('Location', 'http://google.com/')
+      .expect(200, done)
+    })
+
+    it('should preserve trailing slashes when not present', function(done){
+      var app = express();
+
       app.use(function(req, res){
         res.location('http://google.com').end();
       });
@@ -31,6 +45,36 @@ describe('res', function(){
       .expect(200, done)
     })
 
+    it('should not encode bad "url"', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        // This is here to show a basic check one might do which
+        // would pass but then the location header would still be bad
+        if (url.parse(req.query.q).host !== 'google.com') {
+          res.status(400).end('Bad url');
+        }
+        res.location(req.query.q).end();
+      });
+
+      request(app)
+        .get('/?q=http://google.com\\@apple.com')
+        .expect(200)
+        .expect('Location', 'http://google.com\\@apple.com')
+        .end(function (err) {
+          if (err) {
+            throw err;
+          }
+
+          // This ensures that our protocol check is case insensitive
+          request(app)
+            .get('/?q=HTTP://google.com\\@apple.com')
+            .expect(200)
+            .expect('Location', 'HTTP://google.com\\@apple.com')
+            .end(done)
+        });
+    });
+
     it('should not touch already-encoded sequences in "url"', function (done) {
       var app = express()
 

From 084e36506a18774f85206a65d8da04dc1107fc1b Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Wed, 20 Mar 2024 10:09:10 -0500
Subject: [PATCH 427/479] 4.19.0

---
 History.md   | 3 ++-
 package.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 0559bb012c5..877f1c56fbe 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
-unreleased
+4.18.3 / 2024-03-20
 ==========
 
+  * Prevent open redirect allow list bypass due to encodeurl
   * deps: cookie@0.6.0
 
 4.18.3 / 2024-02-29
diff --git a/package.json b/package.json
index 990e98dc1aa..eca07b57c8b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.18.3",
+  "version": "4.19.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 11f2b1db227fd42c2508c427032c1ec671b306be Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Wed, 20 Mar 2024 11:33:31 -0500
Subject: [PATCH 428/479] build: fix build due to inconsistent supertest
 behavior in older versions

---
 test/res.location.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/res.location.js b/test/res.location.js
index 38cab027a83..71fbaec03d4 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -58,7 +58,7 @@ describe('res', function(){
       });
 
       request(app)
-        .get('/?q=http://google.com\\@apple.com')
+        .get('/?q=http://google.com' + encodeURIComponent('\\@apple.com'))
         .expect(200)
         .expect('Location', 'http://google.com\\@apple.com')
         .end(function (err) {
@@ -68,7 +68,7 @@ describe('res', function(){
 
           // This ensures that our protocol check is case insensitive
           request(app)
-            .get('/?q=HTTP://google.com\\@apple.com')
+            .get('/?q=HTTP://google.com' + encodeURIComponent('\\@apple.com'))
             .expect(200)
             .expect('Location', 'HTTP://google.com\\@apple.com')
             .end(done)

From a1fa90fcea7d8e844e1c9938ad095d62669c3abd Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Wed, 20 Mar 2024 16:39:46 -0500
Subject: [PATCH 429/479] fixed un-edited version in history.md for 4.19.0

---
 History.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 877f1c56fbe..b6208ea7e32 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,4 @@
-4.18.3 / 2024-03-20
+4.19.0 / 2024-03-20
 ==========
 
   * Prevent open redirect allow list bypass due to encodeurl

From a003cfab034fbadb1c78ae337ee8ab389adda217 Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Wed, 20 Mar 2024 16:39:46 -0500
Subject: [PATCH 430/479] Allow passing non-strings to res.location with new
 encoding handling checks fixes #5554 #5555

---
 History.md           |  5 +++++
 lib/response.js      |  2 +-
 test/res.location.js | 15 +++++++++++++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b6208ea7e32..2fda95c1551 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased changes
+==========
+
+  * Allow passing non-strings to res.location with new encoding handling checks
+
 4.19.0 / 2024-03-20
 ==========
 
diff --git a/lib/response.js b/lib/response.js
index f7c94d10e78..6fddbf35165 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -905,7 +905,7 @@ res.cookie = function (name, value, options) {
  */
 
 res.location = function location(url) {
-  var loc = url;
+  var loc = String(url);
 
   // "back" is an alias for the referrer
   if (url === 'back') {
diff --git a/test/res.location.js b/test/res.location.js
index 71fbaec03d4..d1bbf4b6879 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -145,5 +145,20 @@ describe('res', function(){
         .expect(200, done)
       })
     })
+
+    if (typeof URL !== 'undefined') {
+      it('should accept an instance of URL', function (done) {
+        var app = express();
+
+        app.use(function(req, res){
+          res.location(new URL('http://google.com/')).end();
+        });
+
+        request(app)
+          .get('/')
+          .expect('Location', 'http://google.com/')
+          .expect(200, done);
+      });
+    }
   })
 })

From 4f0f6cc67d531431c096ea006c2191b92931bbc3 Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Wed, 20 Mar 2024 17:17:59 -0500
Subject: [PATCH 431/479] 4.19.1

---
 History.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 2fda95c1551..c4cdd94dacf 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,4 @@
-unreleased changes
+4.19.1 / 2024-03-20
 ==========
 
   * Allow passing non-strings to res.location with new encoding handling checks
diff --git a/package.json b/package.json
index eca07b57c8b..51c6aba2127 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.19.0",
+  "version": "4.19.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 0b746953c4bd8e377123527db11f9cd866e39f94 Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Thu, 21 Mar 2024 12:13:56 -0500
Subject: [PATCH 432/479] Improved fix for open redirect allow list bypass

Co-authored-by: Jon Church <me@jonchurch.com>
Co-authored-by: Blake Embrey <hello@blakeembrey.com>
---
 History.md           |   5 +
 lib/response.js      |  31 ++---
 test/res.location.js | 307 +++++++++++++++++++++++++++++++++++++------
 3 files changed, 280 insertions(+), 63 deletions(-)

diff --git a/History.md b/History.md
index c4cdd94dacf..f62574a7ee1 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Improved fix for open redirect allow list bypass
+
 4.19.1 / 2024-03-20
 ==========
 
diff --git a/lib/response.js b/lib/response.js
index 6fddbf35165..dd7b3c8201d 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -34,7 +34,6 @@ var extname = path.extname;
 var mime = send.mime;
 var resolve = path.resolve;
 var vary = require('vary');
-var urlParse = require('url').parse;
 
 /**
  * Response prototype.
@@ -56,6 +55,7 @@ module.exports = res
  */
 
 var charsetRegExp = /;\s*charset\s*=/;
+var schemaAndHostRegExp = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\/[^\\\/\?]+/;
 
 /**
  * Set status `code`.
@@ -905,32 +905,23 @@ res.cookie = function (name, value, options) {
  */
 
 res.location = function location(url) {
-  var loc = String(url);
+  var loc;
 
   // "back" is an alias for the referrer
   if (url === 'back') {
     loc = this.req.get('Referrer') || '/';
+  } else {
+    loc = String(url);
   }
 
-  var lowerLoc = loc.toLowerCase();
-  var encodedUrl = encodeUrl(loc);
-  if (lowerLoc.indexOf('https://') === 0 || lowerLoc.indexOf('http://') === 0) {
-    try {
-      var parsedUrl = urlParse(loc);
-      var parsedEncodedUrl = urlParse(encodedUrl);
-      // Because this can encode the host, check that we did not change the host
-      if (parsedUrl.host !== parsedEncodedUrl.host) {
-        // If the host changes after encodeUrl, return the original url
-        return this.set('Location', loc);
-      }
-    } catch (e) {
-      // If parse fails, return the original url
-      return this.set('Location', loc);
-    }
-  }
+  var m = schemaAndHostRegExp.exec(loc);
+  var pos = m ? m[0].length + 1 : 0;
+
+  // Only encode after host to avoid invalid encoding which can introduce
+  // vulnerabilities (e.g. `\\` to `%5C`).
+  loc = loc.slice(0, pos) + encodeUrl(loc.slice(pos));
 
-  // set location
-  return this.set('Location', encodedUrl);
+  return this.set('Location', loc);
 };
 
 /**
diff --git a/test/res.location.js b/test/res.location.js
index d1bbf4b6879..c80b38de6b8 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -2,6 +2,7 @@
 
 var express = require('../')
   , request = require('supertest')
+  , assert = require('assert')
   , url = require('url');
 
 describe('res', function(){
@@ -45,49 +46,6 @@ describe('res', function(){
       .expect(200, done)
     })
 
-    it('should not encode bad "url"', function (done) {
-      var app = express()
-
-      app.use(function (req, res) {
-        // This is here to show a basic check one might do which
-        // would pass but then the location header would still be bad
-        if (url.parse(req.query.q).host !== 'google.com') {
-          res.status(400).end('Bad url');
-        }
-        res.location(req.query.q).end();
-      });
-
-      request(app)
-        .get('/?q=http://google.com' + encodeURIComponent('\\@apple.com'))
-        .expect(200)
-        .expect('Location', 'http://google.com\\@apple.com')
-        .end(function (err) {
-          if (err) {
-            throw err;
-          }
-
-          // This ensures that our protocol check is case insensitive
-          request(app)
-            .get('/?q=HTTP://google.com' + encodeURIComponent('\\@apple.com'))
-            .expect(200)
-            .expect('Location', 'HTTP://google.com\\@apple.com')
-            .end(done)
-        });
-    });
-
-    it('should not touch already-encoded sequences in "url"', function (done) {
-      var app = express()
-
-      app.use(function (req, res) {
-        res.location('https://google.com?q=%A710').end()
-      })
-
-      request(app)
-      .get('/')
-      .expect('Location', 'https://google.com?q=%A710')
-      .expect(200, done)
-    })
-
     describe('when url is "back"', function () {
       it('should set location from "Referer" header', function (done) {
         var app = express()
@@ -146,6 +104,79 @@ describe('res', function(){
       })
     })
 
+    it('should encode data uri', function (done) {
+      var app = express()
+      app.use(function (req, res) {
+        res.location('data:text/javascript,export default () => { }').end();
+      });
+
+      request(app)
+        .get('/')
+        .expect('Location', 'data:text/javascript,export%20default%20()%20=%3E%20%7B%20%7D')
+        .expect(200, done)
+    })
+
+    it('should encode data uri', function (done) {
+      var app = express()
+      app.use(function (req, res) {
+        res.location('data:text/javascript,export default () => { }').end();
+      });
+
+      request(app)
+        .get('/')
+        .expect('Location', 'data:text/javascript,export%20default%20()%20=%3E%20%7B%20%7D')
+        .expect(200, done)
+    })
+
+    it('should consistently handle non-string input: boolean', function (done) {
+      var app = express()
+      app.use(function (req, res) {
+        res.location(true).end();
+      });
+
+      request(app)
+        .get('/')
+        .expect('Location', 'true')
+        .expect(200, done)
+    });
+
+    it('should consistently handle non-string inputs: object', function (done) {
+      var app = express()
+      app.use(function (req, res) {
+        res.location({}).end();
+      });
+
+      request(app)
+        .get('/')
+        .expect('Location', '[object%20Object]')
+        .expect(200, done)
+    });
+
+    it('should consistently handle non-string inputs: array', function (done) {
+      var app = express()
+      app.use(function (req, res) {
+        res.location([]).end();
+      });
+
+      request(app)
+        .get('/')
+        .expect('Location', '')
+        .expect(200, done)
+    });
+
+    it('should consistently handle empty string input', function (done) {
+      var app = express()
+      app.use(function (req, res) {
+        res.location('').end();
+      });
+
+      request(app)
+        .get('/')
+        .expect('Location', '')
+        .expect(200, done)
+    });
+
+
     if (typeof URL !== 'undefined') {
       it('should accept an instance of URL', function (done) {
         var app = express();
@@ -161,4 +192,194 @@ describe('res', function(){
       });
     }
   })
+
+  describe('location header encoding', function() {
+    function createRedirectServerForDomain (domain) {
+      var app = express();
+      app.use(function (req, res) {
+        var host = url.parse(req.query.q, false, true).host;
+        // This is here to show a basic check one might do which
+        // would pass but then the location header would still be bad
+        if (host !== domain) {
+          res.status(400).end('Bad host: ' + host + ' !== ' + domain);
+        }
+        res.location(req.query.q).end();
+      });
+      return app;
+    }
+
+    function testRequestedRedirect (app, inputUrl, expected, expectedHost, done) {
+      return request(app)
+        // Encode uri because old supertest does not and is required
+        // to test older node versions. New supertest doesn't re-encode
+        // so this works in both.
+        .get('/?q=' + encodeURIComponent(inputUrl))
+        .expect('') // No body.
+        .expect(200)
+        .expect('Location', expected)
+        .end(function (err, res) {
+          if (err) {
+            console.log('headers:', res.headers)
+            console.error('error', res.error, err);
+            return done(err, res);
+          }
+
+          // Parse the hosts from the input URL and the Location header
+          var inputHost = url.parse(inputUrl, false, true).host;
+          var locationHost = url.parse(res.headers['location'], false, true).host;
+
+          assert.strictEqual(locationHost, expectedHost);
+
+          // Assert that the hosts are the same
+          if (inputHost !== locationHost) {
+            return done(new Error('Hosts do not match: ' + inputHost + " !== " +  locationHost));
+          }
+
+          return done(null, res);
+        });
+    }
+
+    it('should not touch already-encoded sequences in "url"', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'https://google.com?q=%A710',
+        'https://google.com?q=%A710',
+        'google.com',
+        done
+      );
+    });
+
+    it('should consistently handle relative urls', function (done) {
+      var app = createRedirectServerForDomain(null);
+      testRequestedRedirect(
+        app,
+        '/foo/bar',
+        '/foo/bar',
+        null,
+        done
+      );
+    });
+
+    it('should not encode urls in such a way that they can bypass redirect allow lists', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'http://google.com\\@apple.com',
+        'http://google.com\\@apple.com',
+        'google.com',
+        done
+      );
+    });
+
+    it('should not be case sensitive', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'HTTP://google.com\\@apple.com',
+        'HTTP://google.com\\@apple.com',
+        'google.com',
+        done
+      );
+    });
+
+    it('should work with https', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'https://google.com\\@apple.com',
+        'https://google.com\\@apple.com',
+        'google.com',
+        done
+      );
+    });
+
+    it('should correctly encode schemaless paths', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        '//google.com\\@apple.com/',
+        '//google.com\\@apple.com/',
+        'google.com',
+        done
+      );
+    });
+
+    it('should percent encode backslashes in the path', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'https://google.com/foo\\bar\\baz',
+        'https://google.com/foo%5Cbar%5Cbaz',
+        'google.com',
+        done
+      );
+    });
+
+    it('should encode backslashes in the path after the first backslash that triggered path parsing', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'https://google.com\\@app\\l\\e.com',
+        'https://google.com\\@app%5Cl%5Ce.com',
+        'google.com',
+        done
+      );
+    });
+
+    it('should escape header splitting for old node versions', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'http://google.com\\@apple.com/%0d%0afoo:%20bar',
+        'http://google.com\\@apple.com/%0d%0afoo:%20bar',
+        'google.com',
+        done
+      );
+    });
+
+    it('should encode unicode correctly', function (done) {
+      var app = createRedirectServerForDomain(null);
+      testRequestedRedirect(
+        app,
+        '/%e2%98%83',
+        '/%e2%98%83',
+        null,
+        done
+      );
+    });
+
+    it('should encode unicode correctly even with a bad host', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'http://google.com\\@apple.com/%e2%98%83',
+        'http://google.com\\@apple.com/%e2%98%83',
+        'google.com',
+        done
+      );
+    });
+
+    it('should work correctly despite using deprecated url.parse', function (done) {
+      var app = createRedirectServerForDomain('google.com');
+      testRequestedRedirect(
+        app,
+        'https://google.com\'.bb.com/1.html',
+        'https://google.com\'.bb.com/1.html',
+        'google.com',
+        done
+      );
+    });
+
+    it('should encode file uri path', function (done) {
+      var app = createRedirectServerForDomain('');
+      testRequestedRedirect(
+        app,
+        'file:///etc\\passwd',
+        'file:///etc%5Cpasswd',
+        '',
+        done
+      );
+    });
+  });
 })

From b28db2c12c3bd9cd763316824446f79bf81e0686 Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Mon, 25 Mar 2024 09:26:03 -0500
Subject: [PATCH 433/479] 4.19.2

---
 History.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index f62574a7ee1..ac2e7cf719d 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,4 @@
-unreleased
+4.19.2 / 2024-03-25
 ==========
 
   * Improved fix for open redirect allow list bypass
diff --git a/package.json b/package.json
index 51c6aba2127..f299d882b0d 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.19.1",
+  "version": "4.19.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 94669f9289fdd1c640b0c35acf4d9f8e996a646c Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Mon, 25 Mar 2024 10:03:18 -0500
Subject: [PATCH 434/479] remove duplicate location test for data uri

---
 test/res.location.js | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/test/res.location.js b/test/res.location.js
index c80b38de6b8..141ee901310 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -116,18 +116,6 @@ describe('res', function(){
         .expect(200, done)
     })
 
-    it('should encode data uri', function (done) {
-      var app = express()
-      app.use(function (req, res) {
-        res.location('data:text/javascript,export default () => { }').end();
-      });
-
-      request(app)
-        .get('/')
-        .expect('Location', 'data:text/javascript,export%20default%20()%20=%3E%20%7B%20%7D')
-        .expect(200, done)
-    })
-
     it('should consistently handle non-string input: boolean', function (done) {
       var app = express()
       app.use(function (req, res) {

From 51595d402ba155877e48a2a6c807b956a6d6d376 Mon Sep 17 00:00:00 2001
From: marco-ippolito <marcoippolito54@gmail.com>
Date: Tue, 26 Mar 2024 12:37:28 +0100
Subject: [PATCH 435/479] feat: document beta releases expectations

---
 Release-Process.md | 7 +++++++
 Security.md        | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/Release-Process.md b/Release-Process.md
index 55e62189250..9ea0cf3212e 100644
--- a/Release-Process.md
+++ b/Release-Process.md
@@ -77,6 +77,13 @@ non-patch flow.
 - This branch contains the commits accepted so far that implement the proposal
   in the tracking pull request.
 
+### Beta releases
+
+Beta releases are made from a proposal branch. The version number should be
+incremented to the next minor version with a `-beta` suffix. For example, if the
+next release is `5.0.1`, the beta release would be `5.0.1-beta.0`. The beta
+release should be considered unstable and not suitable for production use.
+
 ### Patch flow
 
 In the patch flow, simple changes are committed to the release branch which
diff --git a/Security.md b/Security.md
index cdcd7a6e0aa..d1c4bb7f022 100644
--- a/Security.md
+++ b/Security.md
@@ -29,6 +29,12 @@ announcement, and may ask for additional information or guidance.
 Report security bugs in third-party modules to the person or team maintaining
 the module.
 
+## Beta releases
+
+Beta releases should be considered unstable and **not suitable for production use**.
+Vulnerabilities found in beta releases should be reported according to the [Reporting a Bug](#reporting-a-bug) section.
+Due to the unstable nature of the branch it is not garanteed that the fix will be released in the next beta release.
+
 ## Disclosure Policy
 
 When the security team receives a security bug report, they will assign it to a

From 88bd6d8e3a91f2059a89493a32952c5e01a1b40a Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Tue, 26 Mar 2024 15:32:34 +0100
Subject: [PATCH 436/479] Update Release-Process.md

Co-authored-by: Wes Todd <wes@wesleytodd.com>
---
 Release-Process.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Release-Process.md b/Release-Process.md
index 9ea0cf3212e..0b95a6f3a7d 100644
--- a/Release-Process.md
+++ b/Release-Process.md
@@ -77,7 +77,7 @@ non-patch flow.
 - This branch contains the commits accepted so far that implement the proposal
   in the tracking pull request.
 
-### Beta releases
+### Pre-release Versions
 
 Beta releases are made from a proposal branch. The version number should be
 incremented to the next minor version with a `-beta` suffix. For example, if the

From 4e3f95c0ea4ba6b3f116e65dbb5828e918ea25fb Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Tue, 26 Mar 2024 15:41:07 +0100
Subject: [PATCH 437/479] Update Security.md

Co-authored-by: Wes Todd <wes@wesleytodd.com>
---
 Security.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Security.md b/Security.md
index d1c4bb7f022..9a9986d73ca 100644
--- a/Security.md
+++ b/Security.md
@@ -29,7 +29,7 @@ announcement, and may ask for additional information or guidance.
 Report security bugs in third-party modules to the person or team maintaining
 the module.
 
-## Beta releases
+## Pre-release Versions
 
 Beta releases should be considered unstable and **not suitable for production use**.
 Vulnerabilities found in beta releases should be reported according to the [Reporting a Bug](#reporting-a-bug) section.

From 51a76366e34a9d5ac238c48ebfbd20a020cb635e Mon Sep 17 00:00:00 2001
From: marco-ippolito <marcoippolito54@gmail.com>
Date: Tue, 26 Mar 2024 15:44:10 +0100
Subject: [PATCH 438/479] refactor: reword to pre-releases

---
 Release-Process.md | 8 ++++----
 Security.md        | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Release-Process.md b/Release-Process.md
index 0b95a6f3a7d..c74f16f08b2 100644
--- a/Release-Process.md
+++ b/Release-Process.md
@@ -79,10 +79,10 @@ non-patch flow.
 
 ### Pre-release Versions
 
-Beta releases are made from a proposal branch. The version number should be
-incremented to the next minor version with a `-beta` suffix. For example, if the
-next release is `5.0.1`, the beta release would be `5.0.1-beta.0`. The beta
-release should be considered unstable and not suitable for production use.
+Alpha and Beta releases are made from a proposal branch. The version number should be
+incremented to the next minor version with a `-beta` or `-alpha` suffix.
+For example, if the next beta release is `5.0.1`, the beta release would be `5.0.1-beta.0`.
+The pre-releases should be considered unstable and not suitable for production use.
 
 ### Patch flow
 
diff --git a/Security.md b/Security.md
index 9a9986d73ca..d49ddd75a24 100644
--- a/Security.md
+++ b/Security.md
@@ -31,9 +31,9 @@ the module.
 
 ## Pre-release Versions
 
-Beta releases should be considered unstable and **not suitable for production use**.
-Vulnerabilities found in beta releases should be reported according to the [Reporting a Bug](#reporting-a-bug) section.
-Due to the unstable nature of the branch it is not garanteed that the fix will be released in the next beta release.
+Alpha and Beta releases should be considered unstable and **not suitable for production use**.
+Vulnerabilities found in pre-releases should be reported according to the [Reporting a Bug](#reporting-a-bug) section.
+Due to the unstable nature of the branch it is not garanteed that the fix will be released in the next pre-release.
 
 ## Disclosure Policy
 

From 6d98d2e1103dfe73cb8efc47521d42c269e5bf08 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Tue, 26 Mar 2024 17:01:11 +0100
Subject: [PATCH 439/479] Update Release-Process.md

Co-authored-by: Chris de Almeida <ctcpip@users.noreply.github.com>
---
 Release-Process.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Release-Process.md b/Release-Process.md
index c74f16f08b2..9ca0a15ab46 100644
--- a/Release-Process.md
+++ b/Release-Process.md
@@ -82,7 +82,7 @@ non-patch flow.
 Alpha and Beta releases are made from a proposal branch. The version number should be
 incremented to the next minor version with a `-beta` or `-alpha` suffix.
 For example, if the next beta release is `5.0.1`, the beta release would be `5.0.1-beta.0`.
-The pre-releases should be considered unstable and not suitable for production use.
+The pre-releases are unstable and not suitable for production use.
 
 ### Patch flow
 

From 36b814811079d8d242e69257de46576822d6bb4f Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Tue, 26 Mar 2024 17:01:17 +0100
Subject: [PATCH 440/479] Update Security.md

Co-authored-by: Chris de Almeida <ctcpip@users.noreply.github.com>
---
 Security.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Security.md b/Security.md
index d49ddd75a24..99e8d537734 100644
--- a/Security.md
+++ b/Security.md
@@ -31,7 +31,7 @@ the module.
 
 ## Pre-release Versions
 
-Alpha and Beta releases should be considered unstable and **not suitable for production use**.
+Alpha and Beta releases are unstable and **not suitable for production use**.
 Vulnerabilities found in pre-releases should be reported according to the [Reporting a Bug](#reporting-a-bug) section.
 Due to the unstable nature of the branch it is not garanteed that the fix will be released in the next pre-release.
 

From 8b6d34963d0bf0944d7da2da6fb2b71e36a61421 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Tue, 26 Mar 2024 17:01:30 +0100
Subject: [PATCH 441/479] Update Security.md

Co-authored-by: Chris de Almeida <ctcpip@users.noreply.github.com>
---
 Security.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Security.md b/Security.md
index 99e8d537734..39f055b3b96 100644
--- a/Security.md
+++ b/Security.md
@@ -33,7 +33,7 @@ the module.
 
 Alpha and Beta releases are unstable and **not suitable for production use**.
 Vulnerabilities found in pre-releases should be reported according to the [Reporting a Bug](#reporting-a-bug) section.
-Due to the unstable nature of the branch it is not garanteed that the fix will be released in the next pre-release.
+Due to the unstable nature of the branch it is not guaranteed that any fixes will be released in the next pre-release.
 
 ## Disclosure Policy
 

From 3ae704f67fbbea3d6ac6aeb9563b5bc48615743f Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Mon, 25 Mar 2024 21:43:35 -0400
Subject: [PATCH 442/479] update ci push trigger only to some branches, ignore
 examples, .md

---
 .github/workflows/ci.yml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 01c82f81960..a16debdef9a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,8 +1,18 @@
 name: ci
 
 on:
-- pull_request
-- push
+  push:
+    branches:
+      - master
+      - '4.x'
+      - '5.x'
+    paths-ignore:
+      - 'examples/**'
+      - '*.md'
+  pull_request:
+    paths-ignore:
+      - 'examples/**'
+      - '*.md'
 
 jobs:
   test:

From 4771ba2bc3b5c6c26dd28783f0dc962d008edab8 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Mon, 25 Mar 2024 22:12:28 -0400
Subject: [PATCH 443/479] crib fastify's ci concurrency logic

https://github.com/fastify/fastify/blob/76674fdf46e4da5f1c18e0c86f615c4b538282cd/.github/workflows/ci.yml#L18
---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a16debdef9a..7fc216da6ce 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,12 @@ on:
       - 'examples/**'
       - '*.md'
 
+# Cancel in progress workflows
+# in the scenario where we already had a run going for that PR/branch/tag but then triggered a new run
+concurrency:
+  group: "${{ github.workflow }} ✨ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest

From d546f93f2f4658c3c03828afacc6dfd26788f7a7 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Mon, 25 Mar 2024 22:29:05 -0400
Subject: [PATCH 444/479] add develop to branches

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7fc216da6ce..81e48233738 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - master
+      - develop
       - '4.x'
       - '5.x'
     paths-ignore:

From 6da57c7819dfefa228ab68c884d701a8cf45f39b Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Mon, 25 Mar 2024 22:45:13 -0400
Subject: [PATCH 445/479] remove examples from the ignore

---
 .github/workflows/ci.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81e48233738..f43deeb5385 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,11 +8,9 @@ on:
       - '4.x'
       - '5.x'
     paths-ignore:
-      - 'examples/**'
       - '*.md'
   pull_request:
     paths-ignore:
-      - 'examples/**'
       - '*.md'
 
 # Cancel in progress workflows

From 2676a1f281e8f1cc73591d3fa8917344dcc60d38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Thu, 4 Apr 2024 13:01:35 +0200
Subject: [PATCH 446/479] docs: add reference to the Threat Model

* docs: add Threat Model

* docs: update reference

Co-authored-by: Chris de Almeida <ctcpip@users.noreply.github.com>

* docs: improve readability

Co-authored-by: Chris de Almeida <ctcpip@users.noreply.github.com>

* docs: add reference to the Threat Model

---------

Co-authored-by: Chris de Almeida <ctcpip@users.noreply.github.com>
---
 Security.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Security.md b/Security.md
index 39f055b3b96..6b5d2b0686e 100644
--- a/Security.md
+++ b/Security.md
@@ -46,6 +46,10 @@ involving the following steps:
   * Prepare fixes for all releases still under maintenance. These fixes will be
     released as fast as possible to npm.
 
+## The Express Threat Model
+
+We are currently working on a new version of the security model,  the most updated version can be found [here](https://github.com/expressjs/security-wg/blob/main/tools/docs/ThreatModel.md)
+
 ## Comments on this Policy
 
 If you have suggestions on how this process could be improved please submit a

From 93cf646d5c3643b0d14563795eb45aba583b1568 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Sun, 7 Apr 2024 09:40:16 -0700
Subject: [PATCH 447/479] docs: add blakeembrey as captain for encodeurl
 (#5579)

---
 Contributing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Contributing.md b/Contributing.md
index a9ba84690cb..599df10360f 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -164,6 +164,7 @@ dissent.  When the PR is merged, a TC member will add them to the proper GitHub/
 - `expressjs/cookie-parser`: @wesleytodd
 - `expressjs/generator`: @wesleytodd
 - `expressjs/statusboard`: @wesleytodd
+- `pillarjs/encodeurl`: @blakeembrey
 - `pillarjs/path-to-regexp`: @blakeembrey
 - `pillarjs/router`: @dougwilson, @wesleytodd
 - `pillarjs/finalhandler`: @wesleytodd
@@ -173,4 +174,3 @@ dissent.  When the PR is merged, a TC member will add them to the proper GitHub/
 - `jshttp/on-finished`: @wesleytodd
 - `jshttp/forwarded`: @wesleytodd
 - `jshttp/proxy-addr`: @wesleytodd
-

From 7f9e5843b9690267cf87efe63b48d45425f9ebc3 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Mon, 8 Apr 2024 09:02:12 -0400
Subject: [PATCH 448/479] add jonchurch as repo captain on several packages

---
 Contributing.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 599df10360f..9baa666b712 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -158,10 +158,12 @@ dissent.  When the PR is merged, a TC member will add them to the proper GitHub/
 
 - `expressjs/express`: @wesleytodd
 - `expressjs/discussions`: @wesleytodd
-- `expressjs/expressjs.com`: @crandmck
-- `expressjs/body-parser`: @wesleytodd
+- `expressjs/expressjs.com`: @crandmck, @jonchurch
+- `expressjs/body-parser`: @wesleytodd, @jonchurch
 - `expressjs/multer`: @LinusU
+- `expressjs/morgan`: @jonchurch
 - `expressjs/cookie-parser`: @wesleytodd
+- `expressjs/cors`: @jonchurch
 - `expressjs/generator`: @wesleytodd
 - `expressjs/statusboard`: @wesleytodd
 - `pillarjs/encodeurl`: @blakeembrey
@@ -169,7 +171,7 @@ dissent.  When the PR is merged, a TC member will add them to the proper GitHub/
 - `pillarjs/router`: @dougwilson, @wesleytodd
 - `pillarjs/finalhandler`: @wesleytodd
 - `pillarjs/request`: @wesleytodd
-- `jshttp/http-errors`: @wesleytodd
+- `jshttp/http-errors`: @wesleytodd, @jonchurch
 - `jshttp/cookie`: @wesleytodd
 - `jshttp/on-finished`: @wesleytodd
 - `jshttp/forwarded`: @wesleytodd

From 815f799310a5627c000d4a5156c1c958e4947b4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Marqu=C3=ADnez=20Prado?=
 <25435858+inigomarquinez@users.noreply.github.com>
Date: Wed, 10 Apr 2024 18:53:52 +0200
Subject: [PATCH 449/479] docs: update reference to the threat model (#5590)

PR: https://github.com/expressjs/express/pull/5590
---
 Security.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Security.md b/Security.md
index 6b5d2b0686e..dcfbe88abd4 100644
--- a/Security.md
+++ b/Security.md
@@ -48,7 +48,7 @@ involving the following steps:
 
 ## The Express Threat Model
 
-We are currently working on a new version of the security model,  the most updated version can be found [here](https://github.com/expressjs/security-wg/blob/main/tools/docs/ThreatModel.md)
+We are currently working on a new version of the security model, the most updated version can be found [here](https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md)
 
 ## Comments on this Policy
 

From 6abec204c0a6dc0b2a7adcd6f118ca5fb757e4aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Wed, 17 Apr 2024 13:53:16 +0200
Subject: [PATCH 450/479] docs: update triage nomination policy (#5600)

PR-URL: https://github.com/expressjs/express/pull/5600
---
 Contributing.md | 31 ++++++++-----------------------
 1 file changed, 8 insertions(+), 23 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 9baa666b712..f2ffe4935a2 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -63,29 +63,14 @@ compromise among committers be the default resolution mechanism.
 Anyone can become a triager! Read more about the process of being a triager in
 [the triage process document](Triager-Guide.md).
 
-[Open an issue in `expressjs/express` repo](https://github.com/expressjs/express/issues/new)
-to request the triage role. State that you have read and agree to the
-[Code of Conduct](Code-Of-Conduct.md) and details of the role.
-
-Here is an example issue content you can copy and paste:
-
-```
-Title: Request triager role for <your GitHub username>
-
-I have read and understood the project's Code of Conduct.
-I also have read and understood the process and best practices around Express triaging.
-
-I request for a triager role for the following GitHub organizations:
-
-jshttp
-pillarjs
-express
-```
-
-Once you have opened your issue, a member of the TC will add you to the `triage` team in
-the organizations requested. They will then close the issue.
-
-Happy triaging!
+Currently, any existing [organization member](https://github.com/orgs/expressjs/people) can nominate 
+a new triager. If you are interested in becoming a triager, our best advice is to actively participate 
+in the community by helping triaging issues and pull requests. As well we recommend
+to engage in other community activities like attending the TC meetings, and participating in the Slack 
+discussions.
+
+You can also reach out to any of the [organization members](https://github.com/orgs/expressjs/people) 
+if you have questions or need guidance.
 
 ## Becoming a Committer
 

From 26e53f0fbcaf1fa71a68a42dcd6c17af05fe6ac9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Wed, 17 Apr 2024 15:13:07 +0200
Subject: [PATCH 451/479] ci: add CodeQL (SAST) (#5433)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR-URL: https://github.com/expressjs/express/pull/5433

---------

Co-authored-by: Íñigo Marquínez Prado <25435858+inigomarquinez@users.noreply.github.com>
---
 .github/workflows/codeql.yml | 66 ++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000000..db4e01aff56
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,66 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["master"]
+  schedule:
+    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        with:
+          languages: javascript
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      # - name: Autobuild
+      #   uses: github/codeql-action/autobuild@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        with:
+          category: "/language:javascript"

From d97d79ed9a25099ec4f0537ad8bf2a9378350a6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Wed, 17 Apr 2024 14:25:38 +0200
Subject: [PATCH 452/479] docs: add UlisesGascon as triage initiative captain

---
 Contributing.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Contributing.md b/Contributing.md
index f2ffe4935a2..4262b0f20db 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -161,3 +161,7 @@ dissent.  When the PR is merged, a TC member will add them to the proper GitHub/
 - `jshttp/on-finished`: @wesleytodd
 - `jshttp/forwarded`: @wesleytodd
 - `jshttp/proxy-addr`: @wesleytodd
+
+### Current Initiative Captains
+
+- Triage team [ref](https://github.com/expressjs/discussions/issues/227): @UlisesGascon

From bf91946bd406b0c6f045fe81331de1725e9cee43 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Sat, 4 May 2024 13:53:09 -0700
Subject: [PATCH 453/479] deps: encodeurl@~2.0.0 (#5569)

---
 History.md           |  6 ++++++
 lib/response.js      | 10 +---------
 package.json         |  2 +-
 test/res.location.js | 17 +++--------------
 4 files changed, 11 insertions(+), 24 deletions(-)

diff --git a/History.md b/History.md
index ac2e7cf719d..1aefd4b9686 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: encodeurl@~2.0.0
+    - Removes encoding of `\`, `|`, and `^` to align better with URL spec
+
 4.19.2 / 2024-03-25
 ==========
 
diff --git a/lib/response.js b/lib/response.js
index dd7b3c8201d..29845a7d830 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -55,7 +55,6 @@ module.exports = res
  */
 
 var charsetRegExp = /;\s*charset\s*=/;
-var schemaAndHostRegExp = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\/[^\\\/\?]+/;
 
 /**
  * Set status `code`.
@@ -914,14 +913,7 @@ res.location = function location(url) {
     loc = String(url);
   }
 
-  var m = schemaAndHostRegExp.exec(loc);
-  var pos = m ? m[0].length + 1 : 0;
-
-  // Only encode after host to avoid invalid encoding which can introduce
-  // vulnerabilities (e.g. `\\` to `%5C`).
-  loc = loc.slice(0, pos) + encodeUrl(loc.slice(pos));
-
-  return this.set('Location', loc);
+  return this.set('Location', encodeUrl(loc));
 };
 
 /**
diff --git a/package.json b/package.json
index f299d882b0d..88e4206fe67 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "2.0.0",
-    "encodeurl": "~1.0.2",
+    "encodeurl": "~2.0.0",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
     "finalhandler": "1.2.0",
diff --git a/test/res.location.js b/test/res.location.js
index 141ee901310..2e88002625f 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -293,23 +293,12 @@ describe('res', function(){
       );
     });
 
-    it('should percent encode backslashes in the path', function (done) {
+    it('should keep backslashes in the path', function (done) {
       var app = createRedirectServerForDomain('google.com');
       testRequestedRedirect(
         app,
         'https://google.com/foo\\bar\\baz',
-        'https://google.com/foo%5Cbar%5Cbaz',
-        'google.com',
-        done
-      );
-    });
-
-    it('should encode backslashes in the path after the first backslash that triggered path parsing', function (done) {
-      var app = createRedirectServerForDomain('google.com');
-      testRequestedRedirect(
-        app,
-        'https://google.com\\@app\\l\\e.com',
-        'https://google.com\\@app%5Cl%5Ce.com',
+        'https://google.com/foo\\bar\\baz',
         'google.com',
         done
       );
@@ -364,7 +353,7 @@ describe('res', function(){
       testRequestedRedirect(
         app,
         'file:///etc\\passwd',
-        'file:///etc%5Cpasswd',
+        'file:///etc\\passwd',
         '',
         done
       );

From 8417c60fcfd7a9523e8783fd3f489d771df1ce44 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Sat, 4 May 2024 17:09:52 -0400
Subject: [PATCH 454/479] skip QUERY method test (#5628)

---
 test/app.router.js | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/test/app.router.js b/test/app.router.js
index 12b6c1fa519..d9ddc69afc5 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -35,8 +35,25 @@ describe('app.router', function(){
   })
 
   describe('methods', function(){
+    function getMajorVersion(versionString) {
+      return versionString.split('.')[0];
+    }
+
+    function shouldSkipQuery(versionString) {
+      // Temporarily skipping this test on 21 and 22
+      // update this implementation to run on those release lines on supported versions once they exist
+      // upstream tracking https://github.com/nodejs/node/pull/51719
+      // express tracking issue: https://github.com/expressjs/express/issues/5615
+      var majorsToSkip = {
+        "21": true,
+        "22": true
+      }
+      return majorsToSkip[getMajorVersion(versionString)]
+    }
+
     methods.concat('del').forEach(function(method){
       if (method === 'connect') return;
+      if (method === 'query' && shouldSkipQuery(process.versions.node)) return
 
       it('should include ' + method.toUpperCase(), function(done){
         var app = express();

From b44191eb3de5fcc94b384d7d6028b8c9a0144231 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Sat, 4 May 2024 18:01:42 -0400
Subject: [PATCH 455/479] ignore ETAG query test as well, reuse skip util
 (#5639)

---
 test/app.router.js    | 18 ++----------------
 test/res.send.js      |  3 +++
 test/support/utils.js | 18 ++++++++++++++++++
 3 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/test/app.router.js b/test/app.router.js
index d9ddc69afc5..ae87092f00f 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -6,6 +6,8 @@ var express = require('../')
   , assert = require('assert')
   , methods = require('methods');
 
+var shouldSkipQuery = require('./support/utils').shouldSkipQuery
+
 describe('app.router', function(){
   it('should restore req.params after leaving router', function(done){
     var app = express();
@@ -35,22 +37,6 @@ describe('app.router', function(){
   })
 
   describe('methods', function(){
-    function getMajorVersion(versionString) {
-      return versionString.split('.')[0];
-    }
-
-    function shouldSkipQuery(versionString) {
-      // Temporarily skipping this test on 21 and 22
-      // update this implementation to run on those release lines on supported versions once they exist
-      // upstream tracking https://github.com/nodejs/node/pull/51719
-      // express tracking issue: https://github.com/expressjs/express/issues/5615
-      var majorsToSkip = {
-        "21": true,
-        "22": true
-      }
-      return majorsToSkip[getMajorVersion(versionString)]
-    }
-
     methods.concat('del').forEach(function(method){
       if (method === 'connect') return;
       if (method === 'query' && shouldSkipQuery(process.versions.node)) return
diff --git a/test/res.send.js b/test/res.send.js
index c92568db6ad..1e1835f8238 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -7,6 +7,8 @@ var methods = require('methods');
 var request = require('supertest');
 var utils = require('./support/utils');
 
+var shouldSkipQuery = require('./support/utils').shouldSkipQuery
+
 describe('res', function(){
   describe('.send()', function(){
     it('should set body to ""', function(done){
@@ -407,6 +409,7 @@ describe('res', function(){
 
       methods.forEach(function (method) {
         if (method === 'connect') return;
+        if (method === 'query' && shouldSkipQuery(process.versions.node)) return
 
         it('should send ETag in response to ' + method.toUpperCase() + ' request', function (done) {
           var app = express();
diff --git a/test/support/utils.js b/test/support/utils.js
index 5b4062e0b2a..440a0269bc1 100644
--- a/test/support/utils.js
+++ b/test/support/utils.js
@@ -16,6 +16,7 @@ exports.shouldHaveBody = shouldHaveBody
 exports.shouldHaveHeader = shouldHaveHeader
 exports.shouldNotHaveBody = shouldNotHaveBody
 exports.shouldNotHaveHeader = shouldNotHaveHeader;
+exports.shouldSkipQuery = shouldSkipQuery
 
 /**
  * Assert that a supertest response has a specific body.
@@ -70,3 +71,20 @@ function shouldNotHaveHeader(header) {
     assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
   };
 }
+
+function getMajorVersion(versionString) {
+  return versionString.split('.')[0];
+}
+
+function shouldSkipQuery(versionString) {
+  // Temporarily skipping this test on 21 and 22
+  // update this implementation to run on those release lines on supported versions once they exist
+  // upstream tracking https://github.com/nodejs/node/pull/51719
+  // express tracking issue: https://github.com/expressjs/express/issues/5615
+  var majorsToSkip = {
+    "21": true,
+    "22": true
+  }
+  return majorsToSkip[getMajorVersion(versionString)]
+}
+

From 4b9cd2fd0e13519a16bc36e8b4212e7924698b2e Mon Sep 17 00:00:00 2001
From: Mert Can Altin <mertgold60@gmail.com>
Date: Sun, 5 May 2024 01:15:53 +0300
Subject: [PATCH 456/479] add support Node.js@22 in the CI (#5627)

Co-authored-by: Mert Can Altin <mert.altin@trendyol.com>
---
 .github/workflows/ci.yml | 4 ++++
 appveyor.yml             | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f43deeb5385..488d394f622 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,6 +49,7 @@ jobs:
         - Node.js 19.x
         - Node.js 20.x
         - Node.js 21.x
+        - Node.js 22.x
 
         include:
         - name: Node.js 0.10
@@ -134,6 +135,9 @@ jobs:
 
         - name: Node.js 21.x
           node-version: "21.6"
+        
+        - name: Node.js 22.x
+          node-version: "22.0"
 
     steps:
     - uses: actions/checkout@v4
diff --git a/appveyor.yml b/appveyor.yml
index ce26523b3aa..629499bf37c 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -23,6 +23,7 @@ environment:
     - nodejs_version: "19.9"
     - nodejs_version: "20.11"
     - nodejs_version: "21.6"
+    - nodejs_version: "22.0"
 cache:
   - node_modules
 install:

From 700349ffaf6140195a2d5f8173dd732c90c5aacc Mon Sep 17 00:00:00 2001
From: Mert Can Altin <mertgold60@gmail.com>
Date: Thu, 9 May 2024 00:02:11 +0300
Subject: [PATCH 457/479] doc: add table of contents, tc/triager lists to
 readme (#5619)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* doc: updated readme file

* doc: updated readme file for doc lint

* Update Readme.md

Co-authored-by: krzysdz <krzysdz@users.noreply.github.com>

* Update Readme.md

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>

* Update Readme.md

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>

* Update Readme.md

Co-authored-by: Christine Belzie <105683440+CBID2@users.noreply.github.com>

* repair readme

* added Emeritus area

* Add @carpasse to the triager team

* removed old collaborators

* add missing triagers

* lint

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* dedent to fix ToC spacing

* fixup! dedent to fix ToC spacing

* us @ for jonchurch

* format names to use github handles first, single line

* added emeritus triagers

* edited title

* added emeritus team members

* added menu head

* edited emeritus

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* edits to TC and anchors

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* Update Readme.md

Co-authored-by: Jon Church <me@jonchurch.com>

* Update Readme.md

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>

* Update Readme.md

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>

* Update Readme.md

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>

* Update Readme.md

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>

* Update Readme.md

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>

---------

Co-authored-by: Mert Can Altin <mert.altin@trendyol.com>
Co-authored-by: krzysdz <krzysdz@users.noreply.github.com>
Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Co-authored-by: Christine Belzie <105683440+CBID2@users.noreply.github.com>
Co-authored-by: Jon Church <me@jonchurch.com>
---
 Readme.md | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 94 insertions(+), 4 deletions(-)

diff --git a/Readme.md b/Readme.md
index d0f3cf56e6d..01acf9e2f19 100644
--- a/Readme.md
+++ b/Readme.md
@@ -1,10 +1,27 @@
 [![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/)
 
-  Fast, unopinionated, minimalist web framework for [Node.js](http://nodejs.org).
+**Fast, unopinionated, minimalist web framework for [Node.js](http://nodejs.org).**
 
-  [![NPM Version][npm-version-image]][npm-url]
-  [![NPM Install Size][npm-install-size-image]][npm-install-size-url]
-  [![NPM Downloads][npm-downloads-image]][npm-downloads-url]
+**This project has a [Code of Conduct][].**
+
+## Table of contents
+
+* [Installation](#Installation)
+* [Features](#Features)
+* [Docs & Community](#docs--community)
+* [Quick Start](#Quick-Start)
+* [Running Tests](#Running-Tests)
+* [Philosophy](#Philosophy)
+* [Examples](#Examples)
+* [Contributing to Express](#Contributing)
+* [TC (Technical Committee)](#tc-technical-committee)
+* [Triagers](#triagers)
+* [License](#license)
+
+
+[![NPM Version][npm-version-image]][npm-url]
+[![NPM Install Size][npm-install-size-image]][npm-install-size-url]
+[![NPM Downloads][npm-downloads-image]][npm-downloads-url]
 
 ```js
 const express = require('express')
@@ -148,6 +165,78 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 
 [List of all contributors](https://github.com/expressjs/express/graphs/contributors)
 
+### TC (Technical Committee)
+
+* [UlisesGascon](https://github.com/UlisesGascon) - **Ulises Gascón** (he/him)
+* [jonchurch](https://github.com/jonchurch) - **Jon Church**
+* [wesleytodd](https://github.com/wesleytodd) - **Wes Todd**
+* [LinusU](https://github.com/LinusU) - **Linus Unnebäck**
+* [blakeembrey](https://github.com/blakeembrey) - **Blake Embrey**
+* [sheplu](https://github.com/sheplu) - **Jean Burellier**
+* [crandmck](https://github.com/crandmck) - **Rand McKinney**
+
+<details>
+<summary>TC emeriti members</summary>
+
+#### TC emeriti members
+
+  * [dougwilson](https://github.com/dougwilson) - **Douglas Wilson**
+  * [hacksparrow](https://github.com/hacksparrow) - **Hage Yaapa**
+  * [jonathanong](https://github.com/jonathanong) - **jongleberry**
+  * [niftylettuce](https://github.com/niftylettuce) - **niftylettuce**
+  * [troygoode](https://github.com/troygoode) - **Troy Goode**
+</details>
+
+
+### Triagers
+
+* [aravindvnair99](https://github.com/aravindvnair99) - **Aravind Nair**
+* [carpasse](https://github.com/carpasse) - **Carlos Serrano**
+* [CBID2](https://github.com/CBID2) - **Christine Belzie**
+* [enyoghasim](https://github.com/enyoghasim) - **David Enyoghasim**
+* [UlisesGascon](https://github.com/UlisesGascon) - **Ulises Gascón** (he/him)
+* [mertcanaltin](https://github.com/mertcanaltin) - **Mert Can Altin**
+* [0ss](https://github.com/0ss) - **Salah**
+* [import-brain](https://github.com/import-brain) - **Eric Cheng** (he/him)
+* [3imed-jaberi](https://github.com/3imed-jaberi) - **Imed Jaberi**
+* [dakshkhetan](https://github.com/dakshkhetan) - **Daksh Khetan** (he/him)
+* [lucasraziel](https://github.com/lucasraziel) - **Lucas Soares Do Rego**
+* [Sushmeet](https://github.com/Sushmeet) - **Sushmeet Sunger**
+
+<details>
+<summary>Triagers emeriti members</summary>
+
+#### Emeritus Triagers
+
+  * [AuggieH](https://github.com/AuggieH) - **Auggie Hudak**
+  * [G-Rath](https://github.com/G-Rath) - **Gareth Jones**
+  * [MohammadXroid](https://github.com/MohammadXroid) - **Mohammad Ayashi**
+  * [NawafSwe](https://github.com/NawafSwe) - **Nawaf Alsharqi**
+  * [NotMoni](https://github.com/NotMoni) - **Moni**
+  * [VigneshMurugan](https://github.com/VigneshMurugan) - **Vignesh Murugan**
+  * [davidmashe](https://github.com/davidmashe) - **David Ashe**
+  * [digitaIfabric](https://github.com/digitaIfabric) - **David**
+  * [e-l-i-s-e](https://github.com/e-l-i-s-e) - **Elise Bonner**
+  * [fed135](https://github.com/fed135) - **Frederic Charette**
+  * [firmanJS](https://github.com/firmanJS) - **Firman Abdul Hakim**
+  * [getspooky](https://github.com/getspooky) - **Yasser Ameur**
+  * [ghinks](https://github.com/ghinks) - **Glenn**
+  * [ghousemohamed](https://github.com/ghousemohamed) - **Ghouse Mohamed**
+  * [gireeshpunathil](https://github.com/gireeshpunathil) - **Gireesh Punathil**
+  * [jake32321](https://github.com/jake32321) - **Jake Reed**
+  * [jonchurch](https://github.com/jonchurch) - **Jon Church**
+  * [lekanikotun](https://github.com/lekanikotun) - **Troy Goode**
+  * [marsonya](https://github.com/marsonya) - **Lekan Ikotun**
+  * [mastermatt](https://github.com/mastermatt) - **Matt R. Wilson**
+  * [maxakuru](https://github.com/maxakuru) - **Max Edell**
+  * [mlrawlings](https://github.com/mlrawlings) - **Michael Rawlings**
+  * [rodion-arr](https://github.com/rodion-arr) - **Rodion Abdurakhimov**
+  * [sheplu](https://github.com/sheplu) - **Jean Burellier**
+  * [tarunyadav1](https://github.com/tarunyadav1) - **Tarun yadav**
+  * [tunniclm](https://github.com/tunniclm) - **Mike Tunnicliffe**
+</details>
+
+
 ## License
 
   [MIT](LICENSE)
@@ -164,3 +253,4 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 [npm-install-size-url]: https://packagephobia.com/result?p=express
 [npm-url]: https://npmjs.org/package/express
 [npm-version-image]: https://badgen.net/npm/v/express
+[Code of Conduct]: https://github.com/expressjs/express/blob/master/Code-Of-Conduct.md

From 897290b68549034fb12f7bbb2cf6dae6c6f36096 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Fri, 10 May 2024 16:09:39 -0700
Subject: [PATCH 458/479] List and sort all projects, add captains

---
 Contributing.md | 76 ++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 59 insertions(+), 17 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 4262b0f20db..46289af6137 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -63,13 +63,13 @@ compromise among committers be the default resolution mechanism.
 Anyone can become a triager! Read more about the process of being a triager in
 [the triage process document](Triager-Guide.md).
 
-Currently, any existing [organization member](https://github.com/orgs/expressjs/people) can nominate 
-a new triager. If you are interested in becoming a triager, our best advice is to actively participate 
+Currently, any existing [organization member](https://github.com/orgs/expressjs/people) can nominate
+a new triager. If you are interested in becoming a triager, our best advice is to actively participate
 in the community by helping triaging issues and pull requests. As well we recommend
-to engage in other community activities like attending the TC meetings, and participating in the Slack 
+to engage in other community activities like attending the TC meetings, and participating in the Slack
 discussions.
 
-You can also reach out to any of the [organization members](https://github.com/orgs/expressjs/people) 
+You can also reach out to any of the [organization members](https://github.com/orgs/expressjs/people)
 if you have questions or need guidance.
 
 ## Becoming a Committer
@@ -139,28 +139,70 @@ the project, their GitHub handle and npm username (if different). The PR will re
 at least 2 approvals from TC members and 2 weeks hold time to allow for comment and/or
 dissent.  When the PR is merged, a TC member will add them to the proper GitHub/npm groups.
 
-### Current Project Captains
+### Active Projects and Captains
 
-- `expressjs/express`: @wesleytodd
-- `expressjs/discussions`: @wesleytodd
-- `expressjs/expressjs.com`: @crandmck, @jonchurch
+- `expressjs/badgeboard`: @wesleytodd
+- `expressjs/basic-auth-connect`: N/A
 - `expressjs/body-parser`: @wesleytodd, @jonchurch
-- `expressjs/multer`: @LinusU
-- `expressjs/morgan`: @jonchurch
+- `expressjs/compression`: N/A
+- `expressjs/connect-multiparty`: N/A
 - `expressjs/cookie-parser`: @wesleytodd
+- `expressjs/cookie-session`: N/A
 - `expressjs/cors`: @jonchurch
+- `expressjs/discussions`: @wesleytodd
+- `expressjs/errorhandler`: N/A
+- `expressjs/express-paginate`: N/A
+- `expressjs/express`: @wesleytodd
+- `expressjs/expressjs.com`: @crandmck, @jonchurch
+- `expressjs/flash`: N/A
 - `expressjs/generator`: @wesleytodd
+- `expressjs/method-override`: N/A
+- `expressjs/morgan`: @jonchurch
+- `expressjs/multer`: @LinusU
+- `expressjs/response-time`: @blakeembrey
+- `expressjs/serve-favicon`: N/A
+- `expressjs/serve-index`: N/A
+- `expressjs/serve-static`: N/A
+- `expressjs/session`: N/A
 - `expressjs/statusboard`: @wesleytodd
-- `pillarjs/encodeurl`: @blakeembrey
-- `pillarjs/path-to-regexp`: @blakeembrey
-- `pillarjs/router`: @dougwilson, @wesleytodd
-- `pillarjs/finalhandler`: @wesleytodd
-- `pillarjs/request`: @wesleytodd
-- `jshttp/http-errors`: @wesleytodd, @jonchurch
+- `expressjs/timeout`: N/A
+- `expressjs/vhost`: N/A
+- `jshttp/accepts`: @blakeembrey
+- `jshttp/basic-auth`: @blakeembrey
+- `jshttp/compressible`: @blakeembrey
+- `jshttp/content-disposition`: @blakeembrey
+- `jshttp/content-type`: @blakeembrey
 - `jshttp/cookie`: @wesleytodd
+- `jshttp/etag`: @blakeembrey
+- `jshttp/forwarded`: @blakeembrey
+- `jshttp/fresh`: @blakeembrey
+- `jshttp/http-assert`: @wesleytodd, @jonchurch
+- `jshttp/http-errors`: @wesleytodd, @jonchurch
+- `jshttp/media-typer`: @blakeembrey
+- `jshttp/methods`: @blakeembrey
+- `jshttp/mime-db`: @blakeembrey
+- `jshttp/mime-types`: @blakeembrey
+- `jshttp/negotiator`: @blakeembrey
 - `jshttp/on-finished`: @wesleytodd
-- `jshttp/forwarded`: @wesleytodd
+- `jshttp/on-headers`: @blakeembrey
 - `jshttp/proxy-addr`: @wesleytodd
+- `jshttp/range-parser`: @blakeembrey
+- `jshttp/statuses`: @blakeembrey
+- `jshttp/type-is`: @blakeembrey
+- `jshttp/vary`: @blakeembrey
+- `pillarjs/cookies`: @blakeembrey
+- `pillarjs/csrf`: N/A
+- `pillarjs/encodeurl`: @blakeembrey
+- `pillarjs/finalhandler`: @wesleytodd
+- `pillarjs/hbs`: N/A
+- `pillarjs/multiparty`: @blakeembrey
+- `pillarjs/parseurl`: @blakeembrey
+- `pillarjs/path-to-regexp`: @blakeembrey
+- `pillarjs/request`: @wesleytodd
+- `pillarjs/resolve-path`: @blakeembrey
+- `pillarjs/router`: @blakeembrey
+- `pillarjs/send`: @blakeembrey
+- `pillarjs/understanding-csrf`: N/A
 
 ### Current Initiative Captains
 

From a7d6d29ed3a8eeb91954447696d1a28b982702a4 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Mon, 13 May 2024 16:12:36 -0700
Subject: [PATCH 459/479] Add @UlisesGascon to mime repos
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 Contributing.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 46289af6137..292fdc40b71 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -180,8 +180,8 @@ dissent.  When the PR is merged, a TC member will add them to the proper GitHub/
 - `jshttp/http-errors`: @wesleytodd, @jonchurch
 - `jshttp/media-typer`: @blakeembrey
 - `jshttp/methods`: @blakeembrey
-- `jshttp/mime-db`: @blakeembrey
-- `jshttp/mime-types`: @blakeembrey
+- `jshttp/mime-db`: @blakeembrey, @UlisesGascon 
+- `jshttp/mime-types`: @blakeembrey, @UlisesGascon 
 - `jshttp/negotiator`: @blakeembrey
 - `jshttp/on-finished`: @wesleytodd
 - `jshttp/on-headers`: @blakeembrey

From 2803a2b35ae37209a44a8d3b19c141482fd57437 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Thu, 23 May 2024 00:29:16 +0200
Subject: [PATCH 460/479] docs: add @UlisesGascon as captain for cookie-parser
 (#5666)

---
 Contributing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Contributing.md b/Contributing.md
index 292fdc40b71..1654cee02f2 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -146,7 +146,7 @@ dissent.  When the PR is merged, a TC member will add them to the proper GitHub/
 - `expressjs/body-parser`: @wesleytodd, @jonchurch
 - `expressjs/compression`: N/A
 - `expressjs/connect-multiparty`: N/A
-- `expressjs/cookie-parser`: @wesleytodd
+- `expressjs/cookie-parser`: @wesleytodd, @UlisesGascon
 - `expressjs/cookie-session`: N/A
 - `expressjs/cors`: @jonchurch
 - `expressjs/discussions`: @wesleytodd

From 689073d657b646b5d01448a6a69f88016f40761b Mon Sep 17 00:00:00 2001
From: Chris de Almeida <ctcpip@users.noreply.github.com>
Date: Wed, 5 Jun 2024 16:25:58 -0500
Subject: [PATCH 461/479] =?UTF-8?q?=E2=9C=A8=20bring=20back=20query=20test?=
 =?UTF-8?q?s=20for=20node=2021=20(#5690)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/ci.yml | 11 +----------
 .npmrc                   |  1 +
 test/support/utils.js    |  3 +--
 3 files changed, 3 insertions(+), 12 deletions(-)
 create mode 100644 .npmrc

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 488d394f622..02137e595ec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -135,7 +135,7 @@ jobs:
 
         - name: Node.js 21.x
           node-version: "21.6"
-        
+
         - name: Node.js 22.x
           node-version: "22.0"
 
@@ -148,15 +148,6 @@ jobs:
         nvm install --default ${{ matrix.node-version }}
         dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
 
-    - name: Configure npm
-      run: |
-        npm config set loglevel error
-        if [[ "$(npm config get package-lock)" == "true" ]]; then
-          npm config set package-lock false
-        else
-          npm config set shrinkwrap false
-        fi
-
     - name: Install npm module(s) ${{ matrix.npm-i }}
       run: npm install --save-dev ${{ matrix.npm-i }}
       if: matrix.npm-i != ''
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 00000000000..43c97e719a5
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+package-lock=false
diff --git a/test/support/utils.js b/test/support/utils.js
index 440a0269bc1..a4d9fb8b548 100644
--- a/test/support/utils.js
+++ b/test/support/utils.js
@@ -77,12 +77,11 @@ function getMajorVersion(versionString) {
 }
 
 function shouldSkipQuery(versionString) {
-  // Temporarily skipping this test on 21 and 22
+  // Temporarily skipping this test on 22
   // update this implementation to run on those release lines on supported versions once they exist
   // upstream tracking https://github.com/nodejs/node/pull/51719
   // express tracking issue: https://github.com/expressjs/express/issues/5615
   var majorsToSkip = {
-    "21": true,
     "22": true
   }
   return majorsToSkip[getMajorVersion(versionString)]

From f42b160bbc0c391c06cad1c6c37eea5305f78cd2 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Fri, 7 Jun 2024 19:48:48 -0400
Subject: [PATCH 462/479] [v4] Deprecate `res.clearCookie` accepting
 `options.maxAge` and `options.expires` (#5672)

* add deprecation notice for res.clearCookie maxAge/expires

* update History.md for clearCookie deprecation change

* add tests to codify deprecated behavior

Co-authored-by: Chris de Almeida <ctcpip@users.noreply.github.com>

---------

Co-authored-by: Chris de Almeida <ctcpip@users.noreply.github.com>
---
 History.md              |  2 ++
 lib/response.js         |  8 ++++++++
 test/res.clearCookie.js | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 42 insertions(+)

diff --git a/History.md b/History.md
index 1aefd4b9686..c02b24ffba2 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: encodeurl@~2.0.0
     - Removes encoding of `\`, `|`, and `^` to align better with URL spec
+  * Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie`
+    - Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
 
 4.19.2 / 2024-03-25
 ==========
diff --git a/lib/response.js b/lib/response.js
index 29845a7d830..68d969ff05b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -822,6 +822,14 @@ res.get = function(field){
  */
 
 res.clearCookie = function clearCookie(name, options) {
+  if (options) {
+    if (options.maxAge) {
+      deprecate('res.clearCookie: Passing "options.maxAge" is deprecated. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.');
+    }
+    if (options.expires) {
+      deprecate('res.clearCookie: Passing "options.expires" is deprecated. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.');
+    }
+  }
   var opts = merge({ expires: new Date(1), path: '/' }, options);
 
   return this.cookie(name, '', opts);
diff --git a/test/res.clearCookie.js b/test/res.clearCookie.js
index fc0cfb99a3d..3d8a6a5a81f 100644
--- a/test/res.clearCookie.js
+++ b/test/res.clearCookie.js
@@ -32,5 +32,37 @@ describe('res', function(){
       .expect('Set-Cookie', 'sid=; Path=/admin; Expires=Thu, 01 Jan 1970 00:00:00 GMT')
       .expect(200, done)
     })
+
+    it('should set expires when passed', function(done) {
+      var expiresAt = new Date()
+      var app = express();
+
+      app.use(function(req, res){
+        res.clearCookie('sid', { expires: expiresAt }).end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('Set-Cookie', 'sid=; Path=/; Expires=' + expiresAt.toUTCString() )
+      .expect(200, done)
+    })
+
+    it('should set both maxAge and expires when passed', function(done) {
+      var maxAgeInMs = 10000
+      var expiresAt = new Date()
+      var expectedExpires = new Date(expiresAt.getTime() + maxAgeInMs)
+      var app = express();
+
+      app.use(function(req, res){
+        res.clearCookie('sid', { expires: expiresAt, maxAge: maxAgeInMs }).end();
+      });
+
+      request(app)
+      .get('/')
+      // yes, this is the behavior. When we set a max-age, we also set expires to a date 10 sec ahead of expires
+      // even if we set max-age only, we will also set an expires 10 sec in the future
+      .expect('Set-Cookie', 'sid=; Max-Age=10; Path=/; Expires=' + expectedExpires.toUTCString())
+      .expect(200, done)
+    })
   })
 })

From 61421a8c0c2abf011868d90df93813992e3c7563 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Sat, 8 Jun 2024 23:25:42 -0400
Subject: [PATCH 463/479] skip QUERY tests for Node 21 only, still not
 supported (#5695)

* skip QUERY tests for Node 21 only, still not supported

QUERY support has now landed in Node 22.2.0, but is still not supported
in 21.7.3

QUERY showed up in http.METHODS in 21.7.2. Only Node versions after that
will attempt to run tests for it, based on the way we dynamically test
members of the http.METHODS array from Node

* update CI to run on 21.7 and 22.2
---
 .github/workflows/ci.yml |  4 ++--
 test/app.router.js       |  4 +++-
 test/res.send.js         |  4 +++-
 test/support/utils.js    | 11 ++++-------
 4 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02137e595ec..920db416d61 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,10 +134,10 @@ jobs:
           node-version: "20.11"
 
         - name: Node.js 21.x
-          node-version: "21.6"
+          node-version: "21.7"
 
         - name: Node.js 22.x
-          node-version: "22.0"
+          node-version: "22.2"
 
     steps:
     - uses: actions/checkout@v4
diff --git a/test/app.router.js b/test/app.router.js
index ae87092f00f..707333f0432 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -39,9 +39,11 @@ describe('app.router', function(){
   describe('methods', function(){
     methods.concat('del').forEach(function(method){
       if (method === 'connect') return;
-      if (method === 'query' && shouldSkipQuery(process.versions.node)) return
 
       it('should include ' + method.toUpperCase(), function(done){
+        if (method === 'query' && shouldSkipQuery(process.versions.node)) {
+          this.skip()
+        }
         var app = express();
 
         app[method]('/foo', function(req, res){
diff --git a/test/res.send.js b/test/res.send.js
index 1e1835f8238..b4cf68a7df6 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -409,9 +409,11 @@ describe('res', function(){
 
       methods.forEach(function (method) {
         if (method === 'connect') return;
-        if (method === 'query' && shouldSkipQuery(process.versions.node)) return
 
         it('should send ETag in response to ' + method.toUpperCase() + ' request', function (done) {
+          if (method === 'query' && shouldSkipQuery(process.versions.node)) {
+            this.skip()
+          }
           var app = express();
 
           app[method]('/', function (req, res) {
diff --git a/test/support/utils.js b/test/support/utils.js
index a4d9fb8b548..5ad4ca98410 100644
--- a/test/support/utils.js
+++ b/test/support/utils.js
@@ -77,13 +77,10 @@ function getMajorVersion(versionString) {
 }
 
 function shouldSkipQuery(versionString) {
-  // Temporarily skipping this test on 22
-  // update this implementation to run on those release lines on supported versions once they exist
-  // upstream tracking https://github.com/nodejs/node/pull/51719
+  // Skipping HTTP QUERY tests on Node 21, it is reported in http.METHODS on 21.7.2 but not supported
+  // update this implementation to run on supported versions of 21 once they exist
+  // upstream tracking https://github.com/nodejs/node/issues/51562
   // express tracking issue: https://github.com/expressjs/express/issues/5615
-  var majorsToSkip = {
-    "22": true
-  }
-  return majorsToSkip[getMajorVersion(versionString)]
+  return Number(getMajorVersion(versionString)) === 21
 }
 

From 6d084715ba6ca5301e9ac1efe4309e555973b364 Mon Sep 17 00:00:00 2001
From: Chris de Almeida <ctcpip@users.noreply.github.com>
Date: Mon, 10 Jun 2024 16:19:11 -0500
Subject: [PATCH 464/479] =?UTF-8?q?=F0=9F=93=9D=20update=20people,=20add?=
 =?UTF-8?q?=20ctcpip=20to=20TC=20(#5683)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Readme.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index 01acf9e2f19..365c7b6104f 100644
--- a/Readme.md
+++ b/Readme.md
@@ -161,8 +161,6 @@ $ npm test
 
 The original author of Express is [TJ Holowaychuk](https://github.com/tj)
 
-The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson)
-
 [List of all contributors](https://github.com/expressjs/express/graphs/contributors)
 
 ### TC (Technical Committee)
@@ -174,6 +172,7 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 * [blakeembrey](https://github.com/blakeembrey) - **Blake Embrey**
 * [sheplu](https://github.com/sheplu) - **Jean Burellier**
 * [crandmck](https://github.com/crandmck) - **Rand McKinney**
+* [ctcpip](https://github.com/ctcpip) - **Chris de Almeida**
 
 <details>
 <summary>TC emeriti members</summary>

From 4cf7eed927d3ccd3f1d0c9a14d562ec0a1635e86 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Wed, 26 Jun 2024 18:23:19 -0400
Subject: [PATCH 465/479] remove minor version pinning from ci (#5722)

---
 .github/workflows/ci.yml | 44 ++++++++++++++++++++--------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 920db416d61..09004fec751 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,83 +61,83 @@ jobs:
           npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 1.x
-          node-version: "1.8"
+          node-version: "1"
           npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 2.x
-          node-version: "2.5"
+          node-version: "2"
           npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 3.x
-          node-version: "3.3"
+          node-version: "3"
           npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 4.x
-          node-version: "4.9"
+          node-version: "4"
           npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
 
         - name: Node.js 5.x
-          node-version: "5.12"
+          node-version: "5"
           npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
 
         - name: Node.js 6.x
-          node-version: "6.17"
+          node-version: "6"
           npm-i: mocha@6.2.2 nyc@14.1.1 supertest@3.4.2
 
         - name: Node.js 7.x
-          node-version: "7.10"
+          node-version: "7"
           npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 8.x
-          node-version: "8.17"
+          node-version: "8"
           npm-i: mocha@7.2.0 nyc@14.1.1
 
         - name: Node.js 9.x
-          node-version: "9.11"
+          node-version: "9"
           npm-i: mocha@7.2.0 nyc@14.1.1
 
         - name: Node.js 10.x
-          node-version: "10.24"
+          node-version: "10"
           npm-i: mocha@8.4.0
 
         - name: Node.js 11.x
-          node-version: "11.15"
+          node-version: "11"
           npm-i: mocha@8.4.0
 
         - name: Node.js 12.x
-          node-version: "12.22"
+          node-version: "12"
           npm-i: mocha@9.2.2
 
         - name: Node.js 13.x
-          node-version: "13.14"
+          node-version: "13"
           npm-i: mocha@9.2.2
 
         - name: Node.js 14.x
-          node-version: "14.20"
+          node-version: "14"
 
         - name: Node.js 15.x
-          node-version: "15.14"
+          node-version: "15"
 
         - name: Node.js 16.x
-          node-version: "16.20"
+          node-version: "16"
 
         - name: Node.js 17.x
-          node-version: "17.9"
+          node-version: "17"
 
         - name: Node.js 18.x
-          node-version: "18.19"
+          node-version: "18"
 
         - name: Node.js 19.x
-          node-version: "19.9"
+          node-version: "19"
 
         - name: Node.js 20.x
-          node-version: "20.11"
+          node-version: "20"
 
         - name: Node.js 21.x
-          node-version: "21.7"
+          node-version: "21"
 
         - name: Node.js 22.x
-          node-version: "22.2"
+          node-version: "22"
 
     steps:
     - uses: actions/checkout@v4

From 2ec589c1133e2eec29a951b4976c50db638f7dd5 Mon Sep 17 00:00:00 2001
From: S M Mahmudul Hasan <he@smmahmudulhasan.com>
Date: Thu, 18 Jul 2024 02:44:03 +0600
Subject: [PATCH 466/479] Fix Contributor Covenant link definition reference in
 attribution section (#5762)

---
 Code-Of-Conduct.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Code-Of-Conduct.md b/Code-Of-Conduct.md
index bbb8996a659..ca4c6b31468 100644
--- a/Code-Of-Conduct.md
+++ b/Code-Of-Conduct.md
@@ -127,7 +127,7 @@ project community.
 
 ## Attribution
 
-This Code of Conduct is adapted from the [Contributor Covenant, version 2.0](cc-20-doc).
+This Code of Conduct is adapted from the [Contributor Covenant, version 2.0][cc-20-doc].
 
 Community Impact Guidelines were inspired by
 [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).

From f4bd86ed361ea9710ed0f7b4634e66c8e3b88b40 Mon Sep 17 00:00:00 2001
From: Jon Church <me@jonchurch.com>
Date: Sat, 27 Jul 2024 14:15:55 -0400
Subject: [PATCH 467/479] Replace Appveyor windows testing with GHA (#5599)

This PR moves us off of Appveyor for windows testing.

We are now doing windows/linux testing on GHA. With the exception of iojs, which we are only testing on Linux and have split out to it's own workflow.

We have also added npm-shrinkwrap.json to our gitignore, in order to not have to configure npm in CI to ignore it. If it's never checked in, it shouldn't exist in CI as you need to go out of your way to create it w/ npm.
---
 .github/workflows/ci.yml   | 288 ++++++++++++++++---------------------
 .github/workflows/iojs.yml |  69 +++++++++
 .gitignore                 |   1 +
 package.json               |   4 +-
 4 files changed, 197 insertions(+), 165 deletions(-)
 create mode 100644 .github/workflows/iojs.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 09004fec751..b3ddd6b23ae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,187 +20,149 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test:
+  lint:
+    name: Lint
     runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node.js {{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: 'lts/*'
+          persist-credentials: false
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts --only=dev
+
+      - name: Run lint
+        run: npm run lint
+
+  test:
+    name: Run tests
     strategy:
       fail-fast: false
       matrix:
-        name:
-        - Node.js 0.10
-        - Node.js 0.12
-        - io.js 1.x
-        - io.js 2.x
-        - io.js 3.x
-        - Node.js 4.x
-        - Node.js 5.x
-        - Node.js 6.x
-        - Node.js 7.x
-        - Node.js 8.x
-        - Node.js 9.x
-        - Node.js 10.x
-        - Node.js 11.x
-        - Node.js 12.x
-        - Node.js 13.x
-        - Node.js 14.x
-        - Node.js 15.x
-        - Node.js 16.x
-        - Node.js 17.x
-        - Node.js 18.x
-        - Node.js 19.x
-        - Node.js 20.x
-        - Node.js 21.x
-        - Node.js 22.x
-
+        os: [ubuntu-latest, windows-latest]
+        node-version:
+          - "0.10"
+          - "0.12"
+          - "4"
+          - "5"
+          - "6"
+          - "7"
+          - "8"
+          - "9"
+          - "10"
+          - "11"
+          - "12"
+          - "13"
+          - "14"
+          - "15"
+          - "16"
+          - "17"
+          - "18"
+          - "19"
+          - "20"
+          - "21"
+          - "22"
+        # Use supported versions of our testing tools under older versions of Node
+        # Install npm in some specific cases where we need to
         include:
-        - name: Node.js 0.10
-          node-version: "0.10"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
-
-        - name: Node.js 0.12
-          node-version: "0.12"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
-
-        - name: io.js 1.x
-          node-version: "1"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
-
-        - name: io.js 2.x
-          node-version: "2"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
-
-        - name: io.js 3.x
-          node-version: "3"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
-
-        - name: Node.js 4.x
-          node-version: "4"
-          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
-
-        - name: Node.js 5.x
-          node-version: "5"
-          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
-
-        - name: Node.js 6.x
-          node-version: "6"
-          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@3.4.2
-
-        - name: Node.js 7.x
-          node-version: "7"
-          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
-
-        - name: Node.js 8.x
-          node-version: "8"
-          npm-i: mocha@7.2.0 nyc@14.1.1
+          - node-version: "0.10"
+            npm-i: "mocha@3.5.3 nyc@10.3.2 supertest@2.0.0"
+            # Npm isn't being installed on windows w/ setup-node for
+            # 0.10 and 0.12, which will end up choking when npm uses es6
+            npm-version: "npm@2.15.1"
 
-        - name: Node.js 9.x
-          node-version: "9"
-          npm-i: mocha@7.2.0 nyc@14.1.1
+          - node-version: "0.12"
+            npm-i: "mocha@3.5.3 nyc@10.3.2 supertest@2.0.0"
+            npm-version: "npm@2.15.11"
 
-        - name: Node.js 10.x
-          node-version: "10"
-          npm-i: mocha@8.4.0
+          - node-version: "4"
+            npm-i: "mocha@5.2.0 nyc@11.9.0 supertest@3.4.2"
 
-        - name: Node.js 11.x
-          node-version: "11"
-          npm-i: mocha@8.4.0
+          - node-version: "5"
+            npm-i: "mocha@5.2.0 nyc@11.9.0 supertest@3.4.2"
+            # fixes https://github.com/npm/cli/issues/681
+            npm-version: "npm@3.10.10"
 
-        - name: Node.js 12.x
-          node-version: "12"
-          npm-i: mocha@9.2.2
+          - node-version: "6"
+            npm-i: "mocha@6.2.2 nyc@14.1.1 supertest@3.4.2"
 
-        - name: Node.js 13.x
-          node-version: "13"
-          npm-i: mocha@9.2.2
+          - node-version: "7"
+            npm-i: "mocha@6.2.2 nyc@14.1.1 supertest@6.1.6"
 
-        - name: Node.js 14.x
-          node-version: "14"
+          - node-version: "8"
+            npm-i: "mocha@7.2.0 nyc@14.1.1"
 
-        - name: Node.js 15.x
-          node-version: "15"
+          - node-version: "9"
+            npm-i: "mocha@7.2.0 nyc@14.1.1"
 
-        - name: Node.js 16.x
-          node-version: "16"
+          - node-version: "10"
+            npm-i: "mocha@8.4.0"
 
-        - name: Node.js 17.x
-          node-version: "17"
+          - node-version: "11"
+            npm-i: "mocha@8.4.0"
 
-        - name: Node.js 18.x
-          node-version: "18"
+          - node-version: "12"
+            npm-i: "mocha@9.2.2"
 
-        - name: Node.js 19.x
-          node-version: "19"
-
-        - name: Node.js 20.x
-          node-version: "20"
-
-        - name: Node.js 21.x
-          node-version: "21"
-
-        - name: Node.js 22.x
-          node-version: "22"
+          - node-version: "13"
+            npm-i: "mocha@9.2.2"
 
+    runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
-
-    - name: Install Node.js ${{ matrix.node-version }}
-      shell: bash -eo pipefail -l {0}
-      run: |
-        nvm install --default ${{ matrix.node-version }}
-        dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
-
-    - name: Install npm module(s) ${{ matrix.npm-i }}
-      run: npm install --save-dev ${{ matrix.npm-i }}
-      if: matrix.npm-i != ''
-
-    - name: Remove non-test dependencies
-      run: npm rm --silent --save-dev connect-redis
-
-    - name: Setup Node.js version-specific dependencies
-      shell: bash
-      run: |
-        # eslint for linting
-        # - remove on Node.js < 12
-        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 12 ]]; then
-          node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
-            grep -E '^eslint(-|$)' | \
-            sort -r | \
-            xargs -n1 npm rm --silent --save-dev
-        fi
-
-    - name: Install Node.js dependencies
-      run: npm install
-
-    - name: List environment
-      id: list_env
-      shell: bash
-      run: |
-        echo "node@$(node -v)"
-        echo "npm@$(npm -v)"
-        npm -s ls ||:
-        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print $2 "=" $3 }' >> "$GITHUB_OUTPUT"
-
-    - name: Run tests
-      shell: bash
-      run: |
-        npm run test-ci
-        cp coverage/lcov.info "coverage/${{ matrix.name }}.lcov"
-
-    - name: Lint code
-      if: steps.list_env.outputs.eslint != ''
-      run: npm run lint
-
-    - name: Collect code coverage
-      run: |
-        mv ./coverage "./${{ matrix.name }}"
-        mkdir ./coverage
-        mv "./${{ matrix.name }}" "./coverage/${{ matrix.name }}"
-
-    - name: Upload code coverage
-      uses: actions/upload-artifact@v3
-      with:
-        name: coverage
-        path: ./coverage
-        retention-days: 1
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Npm version fixes
+        if: ${{matrix.npm-version != ''}}
+        run: npm install -g ${{ matrix.npm-version }}
+
+      - name: Configure npm loglevel
+        run: |
+          npm config set loglevel error
+        shell: bash
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Install Node version specific dev deps
+        if: ${{ matrix.npm-i != '' }}
+        run: npm install --save-dev ${{ matrix.npm-i }}
+
+      - name: Remove non-test dependencies
+        run: npm rm --silent --save-dev connect-redis
+
+      - name: Output Node and NPM versions
+        run: |
+          echo "Node.js version: $(node -v)"
+          echo "NPM version: $(npm -v)"
+
+      - name: Run tests
+        shell: bash
+        run: |
+          npm run test-ci
+          cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov"
+
+      - name: Collect code coverage
+        run: |
+          mv ./coverage "./${{ matrix.node-version }}"
+          mkdir ./coverage
+          mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}"
+
+      - name: Upload code coverage
+        uses: actions/upload-artifact@v3
+        with:
+          name: coverage
+          path: ./coverage
+          retention-days: 1
 
   coverage:
     needs: test
diff --git a/.github/workflows/iojs.yml b/.github/workflows/iojs.yml
new file mode 100644
index 00000000000..c1268abd689
--- /dev/null
+++ b/.github/workflows/iojs.yml
@@ -0,0 +1,69 @@
+name: iojs-ci
+
+on:
+  push:
+    branches:
+      - master
+      - '4.x'
+    paths-ignore:
+      - '*.md'
+  pull_request:
+    paths-ignore:
+      - '*.md'
+
+concurrency:
+  group: "${{ github.workflow }} ✨ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ["1.8", "2.5", "3.3"]
+        include:
+          - node-version: "1.8"
+            npm-i: "mocha@3.5.3 nyc@10.3.2 supertest@2.0.0"
+          - node-version: "2.5"
+            npm-i: "mocha@3.5.3 nyc@10.3.2 supertest@2.0.0"
+          - node-version: "3.3"
+            npm-i: "mocha@3.5.3 nyc@10.3.2 supertest@2.0.0"
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install iojs ${{ matrix.node-version }}
+      shell: bash -eo pipefail -l {0}
+      run: |
+        nvm install --default ${{ matrix.node-version }}
+        dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
+
+    - name: Configure npm
+      run: |
+        npm config set loglevel error
+        npm config set shrinkwrap false
+
+    - name: Install npm module(s) ${{ matrix.npm-i }}
+      run: npm install --save-dev ${{ matrix.npm-i }}
+      if: matrix.npm-i != ''
+
+    - name: Remove non-test dependencies
+      run: npm rm --silent --save-dev connect-redis
+
+    - name: Install Node.js dependencies
+      run: npm install
+
+    - name: List environment
+      id: list_env
+      shell: bash
+      run: |
+        echo "node@$(node -v)"
+        echo "npm@$(npm -v)"
+        npm -s ls ||:
+        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print $2 "=" $3 }' >> "$GITHUB_OUTPUT"
+
+    - name: Run tests
+      shell: bash
+      run: npm run test
+
diff --git a/.gitignore b/.gitignore
index 3a673d9cc09..1bd5c02b28b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 # npm
 node_modules
 package-lock.json
+npm-shrinkwrap.json
 *.log
 *.gz
 
diff --git a/package.json b/package.json
index 88e4206fe67..71781e11d64 100644
--- a/package.json
+++ b/package.json
@@ -91,8 +91,8 @@
   "scripts": {
     "lint": "eslint .",
     "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
-    "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
-    "test-cov": "nyc --reporter=html --reporter=text npm test",
+    "test-ci": "nyc --exclude examples --exclude test --exclude benchmarks --reporter=lcovonly --reporter=text npm test",
+    "test-cov": "nyc --exclude examples --exclude test --exclude benchmarks --reporter=html --reporter=text npm test",
     "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"
   }
 }

From 2177f67f5439494f7a29a8d04f744cc20fb9f201 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Sun, 28 Jul 2024 12:55:10 +0200
Subject: [PATCH 468/479] docs: add OSSF Scorecard badge (#5436)

PR-URL: https://github.com/expressjs/express/pull/5436
---
 Readme.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Readme.md b/Readme.md
index 365c7b6104f..0fa719e237b 100644
--- a/Readme.md
+++ b/Readme.md
@@ -22,6 +22,8 @@
 [![NPM Version][npm-version-image]][npm-url]
 [![NPM Install Size][npm-install-size-image]][npm-install-size-url]
 [![NPM Downloads][npm-downloads-image]][npm-downloads-url]
+[![OpenSSF Scorecard Badge][ossf-scorecard-badge]][ossf-scorecard-visualizer]
+
 
 ```js
 const express = require('express')
@@ -252,4 +254,6 @@ The original author of Express is [TJ Holowaychuk](https://github.com/tj)
 [npm-install-size-url]: https://packagephobia.com/result?p=express
 [npm-url]: https://npmjs.org/package/express
 [npm-version-image]: https://badgen.net/npm/v/express
+[ossf-scorecard-badge]: https://api.securityscorecards.dev/projects/github.com/expressjs/express/badge
+[ossf-scorecard-visualizer]: https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/expressjs/express
 [Code of Conduct]: https://github.com/expressjs/express/blob/master/Code-Of-Conduct.md

From f5b6e67aed1d8e81c30bd5be7bb88dbbfabfeb64 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Sun, 18 Aug 2024 13:37:51 -0500
Subject: [PATCH 469/479] docs: update scorecard link (#5814)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 Readme.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index 0fa719e237b..34362d856f7 100644
--- a/Readme.md
+++ b/Readme.md
@@ -254,6 +254,6 @@ The original author of Express is [TJ Holowaychuk](https://github.com/tj)
 [npm-install-size-url]: https://packagephobia.com/result?p=express
 [npm-url]: https://npmjs.org/package/express
 [npm-version-image]: https://badgen.net/npm/v/express
-[ossf-scorecard-badge]: https://api.securityscorecards.dev/projects/github.com/expressjs/express/badge
-[ossf-scorecard-visualizer]: https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/expressjs/express
+[ossf-scorecard-badge]: https://api.scorecard.dev/projects/github.com/expressjs/express/badge
+[ossf-scorecard-visualizer]: https://ossf.github.io/scorecard-visualizer/#/projects/github.com/expressjs/express
 [Code of Conduct]: https://github.com/expressjs/express/blob/master/Code-Of-Conduct.md

From e35380a39d94937e3d0f7119e0efbc7cd69d003f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Mon, 19 Aug 2024 22:12:24 +0200
Subject: [PATCH 470/479] docs: add @IamLizu to the triage team (#5836)

PR-URL: https://github.com/expressjs/express/pull/5836
---
 Readme.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Readme.md b/Readme.md
index 34362d856f7..bc108d55fc0 100644
--- a/Readme.md
+++ b/Readme.md
@@ -202,6 +202,7 @@ The original author of Express is [TJ Holowaychuk](https://github.com/tj)
 * [3imed-jaberi](https://github.com/3imed-jaberi) - **Imed Jaberi**
 * [dakshkhetan](https://github.com/dakshkhetan) - **Daksh Khetan** (he/him)
 * [lucasraziel](https://github.com/lucasraziel) - **Lucas Soares Do Rego**
+* [IamLizu](https://github.com/IamLizu) - **S M Mahmudul Hasan** (he/him)
 * [Sushmeet](https://github.com/Sushmeet) - **Sushmeet Sunger**
 
 <details>

From c5addb9a17c5b4c9fccdd2c04153a30595e03385 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Wed, 21 Aug 2024 20:15:02 -0700
Subject: [PATCH 471/479] deps: path-to-regexp@0.1.8 (#5603)

---
 History.md         |  2 ++
 package.json       |  2 +-
 test/app.router.js | 26 ++++++++++++++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c02b24ffba2..d81f423d16f 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: path-to-regexp@0.1.8
+    - Adds support for named matching groups in the routes using a regex
   * deps: encodeurl@~2.0.0
     - Removes encoding of `\`, `|`, and `^` to align better with URL spec
   * Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie`
diff --git a/package.json b/package.json
index 71781e11d64..e88618f997b 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "methods": "~1.1.2",
     "on-finished": "2.4.1",
     "parseurl": "~1.3.3",
-    "path-to-regexp": "0.1.7",
+    "path-to-regexp": "0.1.8",
     "proxy-addr": "~2.0.7",
     "qs": "6.11.0",
     "range-parser": "~1.2.1",
diff --git a/test/app.router.js b/test/app.router.js
index 707333f0432..8e427bd6dc7 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -193,6 +193,23 @@ describe('app.router', function(){
       .expect('editing user 10', done);
     })
 
+    if (supportsRegexp('(?<foo>.*)')) {
+      it('should populate req.params with named captures', function(done){
+        var app = express();
+        var re = new RegExp('^/user/(?<userId>[0-9]+)/(view|edit)?$');
+
+        app.get(re, function(req, res){
+          var id = req.params.userId
+            , op = req.params[0];
+          res.end(op + 'ing user ' + id);
+        });
+
+        request(app)
+        .get('/user/10/edit')
+        .expect('editing user 10', done);
+      })
+    }
+
     it('should ensure regexp matches path prefix', function (done) {
       var app = express()
       var p = []
@@ -1114,3 +1131,12 @@ describe('app.router', function(){
     assert.strictEqual(app.get('/', function () {}), app)
   })
 })
+
+function supportsRegexp(source) {
+  try {
+    new RegExp(source)
+    return true
+  } catch (e) {
+    return false
+  }
+}

From a3e7e05e0a435b7b4be25bd38d8d0ca19a773ca9 Mon Sep 17 00:00:00 2001
From: S M Mahmudul Hasan <he@smmahmudulhasan.com>
Date: Thu, 22 Aug 2024 22:25:14 +0600
Subject: [PATCH 472/479] docs: specify new instructions for `question` and
 `discuss`

PR-URL: https://github.com/expressjs/express/pull/5835
---
 Triager-Guide.md | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/Triager-Guide.md b/Triager-Guide.md
index a2909ef30db..c15e6be5313 100644
--- a/Triager-Guide.md
+++ b/Triager-Guide.md
@@ -9,11 +9,18 @@ classification:
 
 * `needs triage`: This can be kept if the triager is unsure which next steps to take
 * `awaiting more info`: If more info has been requested from the author, apply this label.
-* `question`: User questions that do not appear to be bugs or enhancements.
-* `discuss`: Topics for discussion. Might end in an `enhancement` or `question` label.
 * `bug`: Issues that present a reasonable conviction there is a reproducible bug.
 * `enhancement`: Issues that are found to be a reasonable candidate feature additions.
 
+If the issue is a question or discussion, it should be moved to GitHub Discussions.
+
+### Moving Discussions and Questions to GitHub Discussions
+
+For issues labeled with `question` or `discuss`, it is recommended to move them to GitHub Discussions instead:
+
+* **Questions**: User questions that do not appear to be bugs or enhancements should be moved to GitHub Discussions.
+* **Discussions**: Topics for discussion should be moved to GitHub Discussions. If the discussion leads to a new feature or bug identification, it can be moved back to Issues.
+
 In all cases, issues may be closed by maintainers if they don't receive a timely response when
 further information is sought, or when additional questions are asked.
 

From 2a980ad16052e53b398c9953fea50e3daa0b495c Mon Sep 17 00:00:00 2001
From: Anna Bocharova <robin_tail@me.com>
Date: Fri, 23 Aug 2024 22:39:13 +0200
Subject: [PATCH 473/479] merge-descriptors@1.0.3 (#5781)

* Allow patches for `merge-descriptors` dependency

* Set fixed latest of v1 (1.0.3)
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e88618f997b..91e29013a33 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "finalhandler": "1.2.0",
     "fresh": "0.5.2",
     "http-errors": "2.0.0",
-    "merge-descriptors": "1.0.1",
+    "merge-descriptors": "1.0.3",
     "methods": "~1.1.2",
     "on-finished": "2.4.1",
     "parseurl": "~1.3.3",

From 125bb742a38cd97938a3932b47cc301e41c31f5d Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Mon, 9 Sep 2024 14:02:06 -0700
Subject: [PATCH 474/479] path-to-regexp@0.1.10 (#5902)

* path-to-regexp@0.1.10

* Update History.md
---
 History.md   | 3 ++-
 package.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index d81f423d16f..b0aa2e0959e 100644
--- a/History.md
+++ b/History.md
@@ -1,8 +1,9 @@
 unreleased
 ==========
 
-  * deps: path-to-regexp@0.1.8
+  * deps: path-to-regexp@0.1.10
     - Adds support for named matching groups in the routes using a regex
+    - Adds backtracking protection to parameters without regexes defined
   * deps: encodeurl@~2.0.0
     - Removes encoding of `\`, `|`, and `^` to align better with URL spec
   * Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie`
diff --git a/package.json b/package.json
index 91e29013a33..87cf10be9c2 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "methods": "~1.1.2",
     "on-finished": "2.4.1",
     "parseurl": "~1.3.3",
-    "path-to-regexp": "0.1.8",
+    "path-to-regexp": "0.1.10",
     "proxy-addr": "~2.0.7",
     "qs": "6.11.0",
     "range-parser": "~1.2.1",

From 54271f69b511fea198471e6ff3400ab805d6b553 Mon Sep 17 00:00:00 2001
From: Chris de Almeida <ctcpip@users.noreply.github.com>
Date: Mon, 9 Sep 2024 17:16:58 -0500
Subject: [PATCH 475/479] fix: don't render redirect values in anchor href
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 lib/response.js      |  2 +-
 test/res.redirect.js | 24 +++++++++++++++++++++---
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 68d969ff05b..76b6b54a3b8 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -969,7 +969,7 @@ res.redirect = function redirect(url) {
 
     html: function(){
       var u = escapeHtml(address);
-      body = '<p>' + statuses.message[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>'
+      body = '<p>' + statuses.message[status] + '. Redirecting to ' + u + '</p>'
     },
 
     default: function(){
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 5ffc7e48f12..f7214d93312 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -106,7 +106,7 @@ describe('res', function(){
       .set('Accept', 'text/html')
       .expect('Content-Type', /html/)
       .expect('Location', 'http://google.com')
-      .expect(302, '<p>Found. Redirecting to <a href="http://google.com">http://google.com</a></p>', done)
+      .expect(302, '<p>Found. Redirecting to http://google.com</p>', done)
     })
 
     it('should escape the url', function(done){
@@ -122,9 +122,27 @@ describe('res', function(){
       .set('Accept', 'text/html')
       .expect('Content-Type', /html/)
       .expect('Location', '%3Cla\'me%3E')
-      .expect(302, '<p>Found. Redirecting to <a href="%3Cla&#39;me%3E">%3Cla&#39;me%3E</a></p>', done)
+      .expect(302, '<p>Found. Redirecting to %3Cla&#39;me%3E</p>', done)
     })
 
+    it('should not render evil javascript links in anchor href (prevent XSS)', function(done){
+      var app = express();
+      var xss = 'javascript:eval(document.body.innerHTML=`<p>XSS</p>`);';
+      var encodedXss = 'javascript:eval(document.body.innerHTML=%60%3Cp%3EXSS%3C/p%3E%60);';
+
+      app.use(function(req, res){
+        res.redirect(xss);
+      });
+
+      request(app)
+      .get('/')
+      .set('Host', 'http://example.com')
+      .set('Accept', 'text/html')
+      .expect('Content-Type', /html/)
+      .expect('Location', encodedXss)
+      .expect(302, '<p>Found. Redirecting to ' + encodedXss +'</p>', done);
+    });
+
     it('should include the redirect type', function(done){
       var app = express();
 
@@ -137,7 +155,7 @@ describe('res', function(){
       .set('Accept', 'text/html')
       .expect('Content-Type', /html/)
       .expect('Location', 'http://google.com')
-      .expect(301, '<p>Moved Permanently. Redirecting to <a href="http://google.com">http://google.com</a></p>', done);
+      .expect(301, '<p>Moved Permanently. Redirecting to http://google.com</p>', done);
     })
   })
 

From ec4a01b6b8814d7b007f36a3023f4dbafdbc3d09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Tue, 10 Sep 2024 01:36:30 +0200
Subject: [PATCH 476/479] feat: upgrade to body-parser@1.20.3 (#5926)

PR-URL: https://github.com/expressjs/express/pull/5926
---
 History.md                 | 5 ++++-
 package.json               | 2 +-
 test/express.urlencoded.js | 4 ++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index b0aa2e0959e..904db45b233 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,9 @@
 unreleased
 ==========
-
+  * deps: body-parser@0.6.0
+    * add `depth` option to customize the depth level in the parser
+    * IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`)
+  * Remove link renderization in html while using `res.redirect`
   * deps: path-to-regexp@0.1.10
     - Adds support for named matching groups in the routes using a regex
     - Adds backtracking protection to parameters without regexes defined
diff --git a/package.json b/package.json
index 87cf10be9c2..4c0fea2d2e5 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
   "dependencies": {
     "accepts": "~1.3.8",
     "array-flatten": "1.1.1",
-    "body-parser": "1.20.2",
+    "body-parser": "1.20.3",
     "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
     "cookie": "0.6.0",
diff --git a/test/express.urlencoded.js b/test/express.urlencoded.js
index e07432c86c3..537fb797e75 100644
--- a/test/express.urlencoded.js
+++ b/test/express.urlencoded.js
@@ -212,7 +212,7 @@ describe('express.urlencoded()', function () {
       it('should parse deep object', function (done) {
         var str = 'foo'
 
-        for (var i = 0; i < 500; i++) {
+        for (var i = 0; i < 32; i++) {
           str += '[p]'
         }
 
@@ -230,7 +230,7 @@ describe('express.urlencoded()', function () {
             var depth = 0
             var ref = obj.foo
             while ((ref = ref.p)) { depth++ }
-            assert.strictEqual(depth, 500)
+            assert.strictEqual(depth, 32)
           })
           .expect(200, done)
       })

From 9ebe5d500d22cbb2b8aaa73446866b084c747971 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Tue, 10 Sep 2024 02:46:25 +0200
Subject: [PATCH 477/479] feat: upgrade to send@0.19.0 (#5928)

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 904db45b233..9f47885e3d2 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,7 @@
 unreleased
 ==========
+  * deps: send@0.19.0
+    * Remove link renderization in html while redirecting
   * deps: body-parser@0.6.0
     * add `depth` option to customize the depth level in the parser
     * IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`)
diff --git a/package.json b/package.json
index 4c0fea2d2e5..1dc8c5b70cb 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "qs": "6.11.0",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
-    "send": "0.18.0",
+    "send": "0.19.0",
     "serve-static": "1.15.0",
     "setprototypeof": "1.2.0",
     "statuses": "2.0.1",

From 4c9ddc1c47bf579e55c2fe837d76a952e9fd8959 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Tue, 10 Sep 2024 03:24:32 +0200
Subject: [PATCH 478/479] feat: upgrade to serve-static@0.16.0

---
 History.md             | 2 ++
 package.json           | 2 +-
 test/express.static.js | 4 ++--
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 9f47885e3d2..3fe5fc7aaf7 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,7 @@
 unreleased
 ==========
+  * deps: serve-static@0.16.0
+    * Remove link renderization in html while redirecting
   * deps: send@0.19.0
     * Remove link renderization in html while redirecting
   * deps: body-parser@0.6.0
diff --git a/package.json b/package.json
index 1dc8c5b70cb..e9045763b01 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
     "send": "0.19.0",
-    "serve-static": "1.15.0",
+    "serve-static": "1.16.0",
     "setprototypeof": "1.2.0",
     "statuses": "2.0.1",
     "type-is": "~1.6.18",
diff --git a/test/express.static.js b/test/express.static.js
index 245fd5929cc..23e607ed933 100644
--- a/test/express.static.js
+++ b/test/express.static.js
@@ -486,7 +486,7 @@ describe('express.static()', function () {
       request(this.app)
         .get('/users')
         .expect('Location', '/users/')
-        .expect(301, /<a href="\/users\/">/, done)
+        .expect(301, /\/users\//, done)
     })
 
     it('should redirect directories with query string', function (done) {
@@ -508,7 +508,7 @@ describe('express.static()', function () {
         .get('/snow')
         .expect('Location', '/snow%20%E2%98%83/')
         .expect('Content-Type', /html/)
-        .expect(301, />Redirecting to <a href="\/snow%20%E2%98%83\/">\/snow%20%E2%98%83\/<\/a></, done)
+        .expect(301, />Redirecting to \/snow%20%E2%98%83\/</, done)
     })
 
     it('should respond with default Content-Security-Policy', function (done) {

From 21df421ebc7a5249bb31101da666bbf22adc3f18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Tue, 10 Sep 2024 03:32:10 +0200
Subject: [PATCH 479/479] 4.20.0

---
 History.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 3fe5fc7aaf7..887a38f182d 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,4 @@
-unreleased
+4.20.0 / 2024-09-10
 ==========
   * deps: serve-static@0.16.0
     * Remove link renderization in html while redirecting
diff --git a/package.json b/package.json
index e9045763b01..bffa70a6f1c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.19.2",
+  "version": "4.20.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",