Upgrading express 3 to 4
Breaking3.21.2 → 4.22.3Breaking8Security7Deprecated17New42Changed342Fixed80Other73
SecurityFixes a security vulnerability tracked as CVE-2024-51999 and GHSA-pj86-cfqh-vqx6.CVE-2024-51999 ↗
BreakingUpgrade verdict
8 breaking changes and 7 security fixes.
In plain terms
- Remove link renderization in html while using res.redirect.
- Remove minor version pinning from ci.
- Remove unused originalIndex from acceptParams.
- Remove usage of res._headers private field.
Must act Top 5 of 32 that need code or config changes
Node.js requirement changed in 4.1.1: >= 0.8.0 → >= 0.10.0.
Adds accepts ~1.3.8, array-flatten 1.1.1, body-parser ~1.20.5, encodeurl ~2.0.0, finalhandler ~1.3.1, http-errors ~2.0.0, on-finished ~2.4.1, path-to-regexp ~0.1.13, qs ~6.16.0, safe-buffer 5.2.1, serve-static ~1.16.2, setprototypeof 1.2.0, statuses ~2.0.1, type-is ~1.6.18.
Drops basic-auth, commander, connect, mkdirp.
Installs 70 packages in all (was 95).
What you must change
Breaking8
Remove link renderization in html while using res.redirect.
res.redirectRemove minor version pinning from ci.
Remove unused originalIndex from acceptParams.
Remove usage of res._headers private field.
res._headersRemove unnecessary escaping when res.jsonp returns JSON response.
res.jsonpremove.
express.createServer()express()app.configureapp.routerreq.authbasic-authMethod functions called with no path now error instead of being accepted.
Remove duplicate location test for data uri.
Security7
Fixes a security vulnerability tracked as CVE-2024-51999 and GHSA-pj86-cfqh-vqx6.
Backports a fix for CVE-2024-47764 to the 4.x branch.
express vulnerable to XSS via response.redirect()
Low · CVSS 5.0Express.js Open Redirect in malformed URLs
Moderate · CVSS 6.1No Charset in Content-Type Header in express
Moderate · CVSS 6.1Express ressource injection
Moderate · CVSS 4.0Express Open Redirect vulnerability
Low · CVSS 4.7Deprecations to plan for
Deprecated17
Deprecates the "back" magic string in redirects.
res.redirect()[v4] Deprecate res.clearCookie accepting options.maxAge and options.expires.
res.clearCookieoptions.maxAgeoptions.expiresUse https: protocol instead of deprecated git: protocol.
Deprecate string and non-integer arguments to res.status.
res.statusDeprecate leading: in name for app.param(name, fn).
nameapp.param(name, fn)Deprecate req.param() -- use req.params, req.body, or req.query instead.
req.param()req.paramsreq.bodyreq.queryDeprecate app.param(fn).
app.param(fn)Deprecate res.sendfile -- use res.sendFile instead.
res.sendfileres.sendFileDeprecate res.json(status, obj) -- use res.status(status).json(obj) instead.
res.json(status, obj)res.status(status).json(obj)Deprecate res.jsonp(status, obj) -- use res.status(status).jsonp(obj) instead.
res.jsonp(status, obj)res.status(status).jsonp(obj)Deprecate res.send(status, body) -- use res.status(status).send(body) instead.
res.send(status, body)res.status(status).send(body)Deprecate res.redirect(url, status) -- use res.redirect(status, url) instead.
res.redirect(url, status)res.redirect(status, url)Deprecate things with depd module.
depdDeprecate req.host -- use req.hostname instead.
req.hostreq.hostnameDeprecate app.del() -- use app.delete() instead.
app.del()app.delete()Deprecate res.json(obj, status) -- use res.json(status, obj) instead.
res.json(obj, status)res.json(status, obj)res.json(status, num)res.status(status).json(num)Deprecate res.jsonp(obj, status) -- use res.jsonp(status, obj) instead.
res.jsonp(obj, status)res.jsonp(status, obj)res.jsonp(status, num)res.status(status).jsonp(num)