Express v5 blockers

[rmacklin]

I started writing this as a reply to #4920 (comment) but the issue was locked just before I finishing typing my comment.

@dougwilson Thanks for your continued work on express. I'm sorry you've had to deal with reports of bogus security vulnerabilities as well as folks who don't know better assuming that you've abandoned the project. I hope it doesn't get you down. ❤️

I do have a question re:

reach out and I would be happy to Zoom with you or similar and we can work on the remaining items together, like see what you want to help with or hear what there is and you can let me know what you can do.

Are you open to the idea of enumerating the remaining work to be done in public, rather than in private Zoom calls, e.g. on this issue or another one?

It may seem like asking folks to get on a Zoom call is not a big ask, but time zones and other factors could make that a nontrivial barrier. Moreover, documenting this in a public issue would eliminate the need for repeating yourself over N Zoom calls.

The last update said:

Express 5 is pretty much completed at this point, and we're just finishing up the last code merges in upstream modules in order to bump the dependencies finally in the 5.0 branch.

If this is still the case, perhaps you could provide more details about which modules are currently blocked and link to any relevant PRs/issues that are stalled. Even if you'd still prefer to for folks that want to help to first reach out to you, providing this additional detail could help to make those conversations more fruitful.

Anyway, just wanted to pose the question for you to consider. Once again, thanks for your continued work on express and I hope you are doing well!

[dougwilson]

Hi @rmacklin sorry about that, I didn't think there would have been any more real replies, and it was quite out of date anyway, so your new issue is probably for the best. I can certainly work on writing it down. I just suggested Zoom would be easier because it is fast and a conversation. I will need to take some time to gather everything, and will of course no longer be working on Express.js code while I do that. It seems like that is what folks want to see, however, so I think that working on documenting everything out is a higher priority than working on the code at this point. Please let me know if I'm mistaken. I have never been great about documenting these things down in writing, and it is a huge weakness of mine; I am more of a code writer, lol. So please forgive me. I would love it if someone who has that as their strong suit would join to help 'fish' it out of me, lol.

[shadow0500]

Hey I go through your message and would love to join you people in person to work with you and learn from you so I eagerly waiting to hear from you people.

[brainthinks]

HI @dougwilson - I DM'd you on LinkedIn to see if I could be of any help with this.

[isaacpontes]

Hi, @dougwilson! I'm also willing to help, documenting or anything else. Is there a prefered way/channel to talk to you about this?

[TomMiller-mas]

Serious questions, if 5.0 is basically finished, why is it still in Beta? Maybe time to bump it to RC? I have so much on my plate, I don't have time to test a beta. But more than willing to test an RC version. I just want to know if the interface is set. I know sometimes you have to slide in an interface change, but it would be nice to know that you "think" the interface is stable.

[dougwilson]

Yes, that is the next step, to make it rc. Unless there are comtribs to add anything more, I plan to just run the train to get it out. There are a lot of changes between 4 and 5 especially with route path matching I hoped bugs would get flushed out before marked rc was all.

[dougwilson]

HI @dougwilson - I DM'd you on LinkedIn to see if I could be of any help with this.

Sorry I don't really used LinkedIn, but I looked in there and don't see any mesaages on my account. Not sure if it was sent to the wrong account or I don't know where to look, feel free to email me.

[TomMiller-mas]

Yes, that is the next step, to make it rc. Unless there are comtribs to add anything more, I plan to just run the train to get it out. There are a lot of changes between 4 and 5 especially with route path matching I hoped bugs would get flushed out before marked rc was all.

I am an old fart, but back in the day, beta was for working out all the breaking changes and making it work reasonably well with no crashes. And there will be a 5.1, so if you like where the product is at, RC it. And thanks for all your hard work!!!

[cktang88]

Is there an eta on when the RC will be released?

[dougwilson]

It is difficult to make promises for timelines as this is just voluntary work. I am triaging some security reports currently which take the highest priority so that's ultimately the most I can promise in time frame. If these pan in to actual security issues I would say that whatever the next 5 release is is going to be RC.

[rubiin]

@dougwilson would like to help if needed

[valadaptive]

I tried to add error-handling middleware to a web application recently, found out that it doesn't work with async request handlers, and fell down this rabbit hole.

Express 5.0's release date has been continually pushed back since 2015; it seems like people have been told that 5.0's release is just around the corner for the last 8-9 years.

Are there any specific tasks - code, documentation, triaging, etc. - that others can help out with in order to get 5.0 out the door? I understand that you have no specific obligations since this is volunteer work, but it seems like many others are willing to help out with this if they can get an up-to-date roadmap. I'm not sure when the 5.0 milestone or #2237 were last updated, or to what extent they accurately reflect the work left to do.

If it's lack of usage that's blocking the release, you're going to be waiting forever--very few people want to use beta software in production, and it becomes a catch-22 of not wanting to release until more people have used 5.0, but people not wanting to use 5.0 until it's a stable release.

If there's any info on what people can do to help (e.g. what documentation needs to be written, what bugs need to be fixed, what features need to be implemented), I think it'd go a long way towards helping people both understand and help out with 5.0.

[dougwilson]

Sorry about that. I am happy to use my time to write those things down instead of do them if you like. I am admittedly not the best at writing it down, and just typing this from my phone while at work right now, and planned to work on the cookie changes for a 4.x release people need for some Chrome change, so probably a little lower on my list. I figured once I publish that 4 release, I would merge it into the 5 branch and just publish that as 5.0 in the end. Not sure if that helps at all.

Edit: If anyone wanted to see something in 5.0 that is not in the beta, I guess speak now or forever hold your peace :) especially if the way all the new routing works doesn't work well, well, obviously whay is 5.0 will be 5.0, as no breaking changes again until 6.0

[TomMiller-mas]

If the interface changes are complete and you aren't "planning" on any other breaking changes, please RC it. More people will start using it and reporting bugs. RC is for fixing the little stuff. You are leaving the code in a catch-22. Some places just don't mess with beta software but more than happy to use RC software to get the bugs worked out before they put it into production.

[valadaptive]

I don't personally see any issues with the new routing, and the changes have been in the migration guide since last February and I don't know of any way to gather any more feedback.

One issue I see with the current docs is that the guides aren't versioned, and it looks like they're still written for 4.x. I could try to either move the guides into 4x/5x sections like the rest of the docs, or just create a 5x branch which replaces the guides in-place. Assuming the 5.x migration guide is still up-to-date, I could also try porting some of the guides over.

[dougwilson]

Sure, I can make a RC instead of the final if that is what you want. I just want to do whatever people want, and if you want me to release the above as a RC first and then wait more for testing, I can definitely do that 👍

[dougwilson]

Yea, I think there is still more ways to make the website better, because you are correct, the guides are not versioned in any way, and ideally for 5 they would be using async probably a lot more and whatever else is relevant to 5.

[jdhiro]

Doug, I'd like to add to the many thanks for maintaining this project.

Sure, I can make a RC instead of the final if that is what you want. I just want to do whatever people want, and if you want me to release the above as a RC first and then wait more for testing, I can definitely do that 👍

With this many years of baking, I'd suggest releasing 5.0 final. That way people can start using this, and submitting PRs if they find anything (any bugs). Thanks!

[dougwilson]

Yea, definitely, we can always accept bugs and features, just not breaking changes of course as much as possible. And of course just any change in behavior in 5 compared to 4 is not a bug :) just putting that out there as that is what went on with the 3 to 4 era, people would call changes between the two bugs and wanted to revert or change in some additional breaking way. I don't think we should have any ones like that this time; most of the routing changes are bc 5 now follows the URLPattern spec I would think.

[joeyguerra]

I've been using express version 5, trying to put it through its paces. looks good so far. Ready to merge it and release it?

[jdhiro]

Maybe an Express 5 Christmas Present? 😄

[soulchild]

I just wanted to take the current state of Express 5 for a test drive, but realized there aren't any typings on DT yet, is that correct? That's definitely (haha!) something which should be taken care of before Express 5 gets a final release. Or am I missing something?

[VaguelySerious]

@soulchild Express types are currently maintained in https://github.com/DefinitelyTyped/DefinitelyTyped and not part of the express repository. Once express 5 is released, we can make a PR to update @types/express. We can also add native types as 5.1 or similar, since it's not a breaking change, but IMO it's important we release express 5.0 as soon as possible so that dependent libraries and types can be updated by other maintainers.

Edit: also, btw, in the interim, you can totally use express@5 with @types/express@4.17. I've been using that for a while and it's working fine. The slight mismatch doesn't stop you from compiling your typescript, but might aggravate your linter a little. I'm using the following type patch:

declare module "express-serve-static-core" {
  export interface RequestHandler<
    P = ParamsDictionary,
    ResBody = any,
    ReqBody = any,
    ReqQuery = ParsedQs,
    LocalsObj extends Record<string, any> = Record<string, any>,
  > {
    (
      req: Request<P, ResBody, ReqBody, ReqQuery, LocalsObj>,
      res: Response<ResBody, LocalsObj>,
      next: NextFunction,
      // This is the only line that's different from the original type
    ): void | Promise<void>;
  }
}

[joeyguerra]

I concur. Software is never really done. It's alive.

[mwanago]

@dougwilson I'm looking forward to seeing Express 5 released <3

[steve1337]

I could not agree more #5205 (comment)

I would also vote for making it final as is. Better to start moving forward with all the improvements that are already developed and cut a release version. Any other additional requests for changes and features can then go into v6.

[dungmv]

the latest v5 was release from 2022, and now it's 2024.

[melroy89]

I really really wish we will get Express v5 in 2024.

[wesleytodd]

Hey @melroy89 (and others in this thread), if you are interested in participating we have been working on getting the project back on track. Check out the initial plan here and our top priorities we put on the TC agenda.