Backlog for next releases #380

This is the current releases backlog in terms of status and priorities

Important notes:

• The state of the backlog is always reflected in the latest edition of this message.
• Packages and releases are prioritized based on user impact, with security updates and hotfixes considered the most critical.
• Some packages require maintenance releases, as it has been several years since their last update. These items are considered low priority.
• Ideally, each release has a clear leader.

Security Releases (Highest priority)

We intentionally do not disclose more details. This helps us organize the backlog more effectively, as not everyone is aware of which security patches are currently in progress.

• body-parser (repo, npm)
  • semver-patch: GHSA-wqch-xfxh-vrr4
  • 2.2.1: Release: 2.2.1 body-parser#659
• express (repo, npm)
  • semver-minor: GHSA-pj86-cfqh-vqx6
  • release: Release: 4.22.0 express#6921
  • release: Release: 5.2.0 express#6920
• multiparty (repo, npm)
  • semver-minor: GHSA-65x3-rw7q-gx94

This is organized in a specific order to ensure we apply patches on the latest versions. For example, Express depends on body-parser.

High Priority

The community is waiting for these releases, which contain patches and features that we need to ship soon.

• cors (repo, npm)
  • Priority: Operational issues with CORS cors#346
  • Lead: @UlisesGascon / @efekrskl
• compressible (repo, npm):
  • Proposal 2.0.19: Release: 2.0.19 jshttp/compressible#32
  • Lead: @UlisesGascon
• on-finished (repo, npm):
  • semver-major: Release Proposal: on-finished@3.0.0 jshttp/on-finished#57
  • Lead: @Phillip9587 / @UlisesGascon
• mime-db (repo, npm):
  • Backlog: Backlog for Release 1.55.0 jshttp/mime-db#414
  • Create a release proposal PR
  • Lead: @UlisesGascon
• iconv-lite (repo, npm):
  • Release: release: 0.7.1 pillarjs/iconv-lite#359
  • Release: 1.x (TBC)
  • Lead: @bjohansebas
• content-disposition (repo, npm):
  • Proposal 1.0.1: Release: 1.0.1 jshttp/content-disposition#58
  • Lead: @Phillip9587 / @UlisesGascon
• mime-types (repo, npm):
  • Proposal 3.0.2 Release: 3.0.2 jshttp/mime-types#169
  • Lead: @UlisesGascon
• http-errors (repo, npm):
  • Motivation: This would deduplicate the statuses package in our dependency tree: npm graph
  • Proposal 2.0.1 Release: 2.0.1 jshttp/http-errors#140
  • Lead: @UlisesGascon
• serve-static (repo, npm)
  • Lead: @UlisesGascon
  • Priority: deps: send@~0.19.1 serve-static#227
  • Release: Release: 2.2.1 serve-static#228
  • Release: Release: 1.16.3 serve-static#229
• send (repo, npm)
  • Lead: @UlisesGascon
  • Priority: deps: use tilde notation and update certain dependencies pillarjs/send#279
  • Release: Release: 1.2.1 pillarjs/send#281
  • Release: Release: 0.19.2 pillarjs/send#280
• finalhandler (repo, npm)
  • Lead: @UlisesGascon
  • Priority: deps: use tilde notation and update certain dependencies pillarjs/finalhandler#118 and fix: update engines reference in the pkg pillarjs/finalhandler#119
  • Release: Release: 2.1.1 pillarjs/finalhandler#120
  • Release: Release: 1.3.2 pillarjs/finalhandler#121
• body-parser (repo, npm)
  • Lead: @UlisesGascon
  • Priority: deps: use tilde notation and update certain dependencies body-parser#668
  • Release: Release: 1.20.4 body-parser#672
  • 2.2.2: Release: 2.2.2 body-parser#691
• cookie (repo, npm)
  • Lead: @blakeembrey
  • cookie@1.1.0: https://github.com/jshttp/cookie/releases/tag/v1.1.0

Medium Priority

The community is waiting for these releases, which include patches and features that we can release without urgency. In some cases, the release backlog is not yet ready.

• multer (repo, npm):
  • semver-major and semver-patch pending: Releases Backlog (2.1.0 and 3.0.0) multer#1310
  • Lead: @bjohansebas / @UlisesGascon / @LinusU
• compression (repo, npm):
  • semver-major: Compression v2 compression#234
  • Lead: @bjohansebas / @UlisesGascon
• express-session (repo, npm):
  • semver-major: backlog for express-session@2.x session#1006
  • Lead: @UlisesGascon / @bjohansebas
• response-time (repo, npm)
  • semver-major: Discussion: Proposed Changes for expressjs/response-time Next Major Version response-time#25
  • Lead: @carpasse / @UlisesGascon
• basic-auth-connect (repo, npm):
  • semver-major: Backlog: Release v2.0 basic-auth-connect#8
  • Lead: @UlisesGascon
• hbs (repo, npm)
  • semver-major: https://github.com/pillarjs/hbs/tree/5.0
  • Lead: @UlisesGascon / @mfdebian
• on-headers (repo, npm):
  • semver-major: on-headers v2 jshttp/on-headers#18
  • Lead: @bjohansebas / @UlisesGascon
• content-type (repo, npm):
  • semver-major: v2.0.0 - Major Release (Proposal) jshttp/content-type#27
  • Lead: @Phillip9587 / @UlisesGascon
• basic-auth (repo, npm):
  • semver-major: basic-auth v3 - Proposal jshttp/basic-auth#70
  • Lead: @Phillip9587 / @UlisesGascon
• errorhandler (repo, npm)
  • Lead: @UlisesGascon / @nanotower
• cookies (repo, npm)
  • semver-major proposal: 1.0.0 pillarjs/cookies#48
  • Lead: @UlisesGascon / @imangas
• http-assert (repo, npm)
  • Motivation: Update http-errors to v2 jshttp/http-assert#37
  • Lead: @UlisesGascon

Backlog

We need to plan the release content. These releases are considered blocked until we gain more traction.

• serve-index (repo, npm)
• method-override (repo, npm)
• vhost (repo, npm)
• parseurl (repo, npm)
• csrf (repo, npm)
• resolve-path (repo, npm)
• media-typer (repo, npm)
• vary (repo, npm)
• methods (repo, npm)
• range-parser (repo, npm)
• proxy-addr (repo, npm)
• etag (repo, npm)
• http-errors (repo, npm)
• forwarded (repo, npm)
  • semver-major proposal: v1.0.0-rc.1 jshttp/forwarded#1

On hold

We released a version recently, but we can prepare a new one containing the remaining open issues, dependency upgrades, and other improvements.

• morgan (repo, npm)
• serve-favicon (repo, npm)
• connect-timeout (repo, npm)
• statuses (repo, npm)
• fresh (repo, npm)
• negotiator (repo, npm)
• type-is (repo, npm)
• encodeurl (repo, npm)
• iconv-lite (repo, npm)
• router (repo, npm)
• cookie-parser (repo, npm)
• cookie-session (repo, npm)
• path-to-regexp (repo, npm)