Starstruk Logo MarkStarstruk

4.20.0

expressjs/express4.20.0Sep 10, 2024by UlisesGascon

AI Summary

Important release with breaking changes to URL-encoded parsing depth and redirect behavior. The default depth level for parsing URL-encoded data is now 32 instead of Infinity.

Key Highlights

  • Default depth level for parsing URL-encoded data changed from Infinity to 32
  • Removed link renderization in HTML while using res.redirect
  • Upgraded path-to-regexp to 0.1.10
  • Upgraded merge-descriptors dependency

Breaking Changes

  • URL-encoded body parsing depth defaults to 32 instead of Infinity - may affect deeply nested form data
  • Link rendering in HTML redirects removed

New Features

  • Security and performance improvements through depth limiting

Full Release Notes

## What's Changed

### Important

* IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`)
* Remove link renderization in html while using `res.redirect`

### Other Changes
* 4.19.2 Staging by @wesleytodd in https://github.com/expressjs/express/pull/5561
* remove duplicate location test for data uri by @wesleytodd in https://github.com/expressjs/express/pull/5562
* feat: document beta releases expectations by @marco-ippolito in https://github.com/expressjs/express/pull/5565
* Cut down on duplicated CI runs by @jonchurch in https://github.com/expressjs/express/pull/5564
* Add a Threat Model by @UlisesGascon in https://github.com/expressjs/express/pull/5526
* Assign captain of encodeurl by @blakeembrey in https://github.com/expressjs/express/pull/5579
* Nominate jonchurch as repo captain for `http-errors`, `expressjs.com`, `morgan`, `cors`, `body-parser` by @jonchurch in https://github.com/expressjs/express/pull/5587
* docs: update Security.md by @inigomarquinez in https://github.com/expressjs/express/pull/5590
* docs: update triage nomination policy by @UlisesGascon in https://github.com/expressjs/express/pull/5600
* Add CodeQL (SAST) by @UlisesGascon in https://github.com/expressjs/express/pull/5433
* docs: add UlisesGascon as triage initiative captain by @UlisesGascon in https://github.com/expressjs/express/pull/5605
* deps: encodeurl@~2.0.0 by @blakeembrey in https://github.com/expressjs/express/pull/5569
* skip QUERY method test by @jonchurch in https://github.com/expressjs/express/pull/5628
* ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in https://github.com/expressjs/express/pull/5639
* add support Node.js@22 in the CI by @mertcanaltin in https://github.com/expressjs/express/pull/5627
* doc: add table of contents, tc/triager lists to readme by @mertcanaltin in https://github.com/expressjs/express/pull/5619
* List and sort all projects, add captains by @blakeembrey in https://github.com/expressjs/express/pull/5653
* docs: add @UlisesGascon as captain for cookie-parser by @UlisesGascon in https://github.com/expressjs/express/pull/5666
* ✨ bring back query tests for node 21 by @ctcpip in https://github.com/expressjs/express/pull/5690
* [v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` by @jonchurch in https://github.com/expressjs/express/pull/5672
* skip QUERY tests for Node 21 only, still not supported by @jonchurch in https://github.com/expressjs/express/pull/5695
* 📝 update people, add ctcpip to TC by @ctcpip in https://github.com/expressjs/express/pull/5683
* remove minor version pinning from ci by @jonchurch in https://github.com/expressjs/express/pull/5722
* Fix link variable use in attribution section of CODE OF CONDUCT by @IamLizu in https://github.com/expressjs/express/pull/5762
* Replace Appveyor windows testing with GHA by @jonchurch in https://github.com/expressjs/express/pull/5599
* Add OSSF Scorecard badge by @UlisesGascon in https://github.com/expressjs/express/pull/5436
* update scorecard link by @bjohansebas in https://github.com/expressjs/express/pull/5814
* Nominate @IamLizu to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/5836
* deps: path-to-regexp@0.1.8 by @blakeembrey in https://github.com/expressjs/express/pull/5603
* docs: specify new instructions for `question` and `discuss` by @IamLizu in https://github.com/expressjs/express/pull/5835
* 4.x: Upgrade `merge-descriptors` dependency by @RobinTail in https://github.com/expressjs/express/pull/5781
* path-to-regexp@0.1.10 by @blakeembrey in https://github.com/expressjs/express/pull/5902

## New Contributors
* @marco-ippolito made their first contribution in https://github.com/expressjs/express/pull/5565
* @inigomarquinez made their first contribution in https://github.com/expressjs/express/pull/5590
* @mertcanaltin made their first contribution in https://github.com/expressjs/express/pull/5627
* @ctcpip made their first contribution in https://github.com/expressjs/express/pull/5690
* @bjohansebas made their first contribution in https://github.com/expressjs/express/pull/5814

**Full Changelog**: https://github.com/expressjs/express/compare/4.19.1...4.20.0