4.19.0

expressjs/express4.19.0Mar 20, 2024by wesleytodd

AI Summary

Security-focused release that prevents open redirect allow list bypass vulnerabilities. Includes documentation updates and project governance improvements.

Key Highlights

Fix for open redirect allow list bypass vulnerability
Documentation updates for release process
Project governance changes - TC activity rules loosened
Added note on updating docs for new releases

New Features

Security fix for open redirect allow list bypass (CVE related)

Full Release Notes

## What's Changed
* fix typo in release date by @UlisesGascon in https://github.com/expressjs/express/pull/5527
* docs: nominating @wesleytodd to be project captian by @wesleytodd in https://github.com/expressjs/express/pull/5511
* docs: loosen TC activity rules by @wesleytodd in https://github.com/expressjs/express/pull/5510
* Add note on how to update docs for new release by @crandmck in https://github.com/expressjs/express/pull/5541
* [Prevent open redirect allow list bypass due to encodeurl](https://github.com/expressjs/express/pull/5551/commits/660ccf5fa33dd0baab069e5c8ddd9ffe7d8bbff1)
* Release 4.19.0 by @wesleytodd in https://github.com/expressjs/express/pull/5551

## New Contributors
* @crandmck made their first contribution in https://github.com/expressjs/express/pull/5541

**Full Changelog**: https://github.com/expressjs/express/compare/4.18.3...4.19.0