As part of the plan of publishing 5.0, we need to upgrade the dependencies. The idea is to create better visibility on these deps. Please note that the list has been compared against 5.0 package.json.

Dependencies that are not directly owned by expressjs / PillarsJS / jshttp.

List

• array-flatten (removed at Use Array.flat instead of array-flatten express#5677)
• cookie-signature - used 1.0.6 - current 1.2.1 (maybe fixed by Upgrade cookie signature express#5833)
• debug - used 3.1.0 - current 4.3.6 (fixed by chore: upgrade debug dep from 3.10 to 4.3.6 express#5829)
• depd
• encodeurl
• escape-html
• etag
• fresh
• merge-descriptors - used 1.0.1 - current 2.0.0 (fixed by 5.x: Upgrading merge-descriptors with allowing minors express#5782)
• methods
• path-is-absolute (deprecated, removed by refactor: replace 'path-is-absolute' dep with node:path isAbsolute method express#5830)
• qs - used 6.11.0 - current 6.13.0 (fixed by chore: upgrade qs dp from 6.11.0 to 6.13.0 express#5847)
• safe-buffer
• setprototypeof
• utils-merge

Reference

• Express 5.0 - last push! #233