History.md

5.0.0 / 2024-09-10

• remove:
  • path-is-absolute dependency - use path.isAbsolute instead
• breaking:
  • res.status() accepts only integers, and input must be greater than 99 and less than 1000
    • will throw a RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000. for inputs outside this range
    • will throw a TypeError: Invalid status code: ${code}. Status code must be an integer. for non integer inputs
  • deps: send@1.0.0
  • res.redirect('back') and res.location('back') is no longer a supported magic string, explicitly use req.get('Referrer') || '/'.
• change:
  • res.clearCookie will ignore user provided maxAge and expires options
• deps: cookie-signature@^1.2.1
• deps: debug@4.3.6
• deps: merge-descriptors@^2.0.0
• deps: serve-static@^2.1.0
• deps: qs@6.13.0
• deps: accepts@^2.0.0
• deps: mime-types@^3.0.0
  • application/javascript => text/javascript
• deps: type-is@^2.0.0
• deps: content-disposition@^1.0.0
• deps: finalhandler@^2.0.0
• deps: fresh@^2.0.0
• deps: body-parser@^2.0.1
• deps: send@^1.1.0

5.0.0-beta.3 / 2024-03-25

This incorporates all changes after 4.19.1 up to 4.19.2.

5.0.0-beta.2 / 2024-03-20

This incorporates all changes after 4.17.2 up to 4.19.1.

5.0.0-beta.1 / 2022-02-14

This is the first Express 5.0 beta release, based off 4.17.2 and includes changes from 5.0.0-alpha.8.

• change:
  • Default "query parser" setting to 'simple'
  • Requires Node.js 4+
  • Use mime-types for file to content type mapping
• deps: array-flatten@3.0.0
• deps: body-parser@2.0.0-beta.1
  • req.body is no longer always initialized to {}
  • urlencoded parser now defaults extended to false
  • Use on-finished to determine when body read
• deps: router@2.0.0-beta.1
  • Add new ?, *, and + parameter modifiers
  • Internalize private router.process_params method
  • Matching group expressions are only RegExp syntax
  • Named matching groups no longer available by position in req.params
  • Regular expressions can only be used in a matching group
  • Remove debug dependency
  • Special * path segment behavior removed
  • deps: array-flatten@3.0.0
  • deps: parseurl@~1.3.3
  • deps: path-to-regexp@3.2.0
  • deps: setprototypeof@1.2.0
• deps: send@1.0.0-beta.1
  • Change dotfiles option default to 'ignore'
  • Remove hidden option; use dotfiles option instead
  • Use mime-types for file to content type mapping
  • deps: debug@3.1.0
• deps: serve-static@2.0.0-beta.1
  • Change dotfiles option default to 'ignore'
  • Remove hidden option; use dotfiles option instead
  • Use mime-types for file to content type mapping
  • deps: send@1.0.0-beta.1

5.0.0-alpha.8 / 2020-03-25

This is the eighth Express 5.0 alpha release, based off 4.17.1 and includes changes from 5.0.0-alpha.7.

5.0.0-alpha.7 / 2018-10-26

This is the seventh Express 5.0 alpha release, based off 4.16.4 and includes changes from 5.0.0-alpha.6.

The major change with this alpha is the basic support for returned, rejected Promises in the router.

• remove:
  • path-to-regexp dependency
• deps: debug@3.1.0
  • Add DEBUG_HIDE_DATE environment variable
  • Change timer to per-namespace instead of global
  • Change non-TTY date format
  • Remove DEBUG_FD environment variable support
  • Support 256 namespace colors
• deps: router@2.0.0-alpha.1
  • Add basic support for returned, rejected Promises
  • Fix JSDoc for Router constructor
  • deps: debug@3.1.0
  • deps: parseurl@~1.3.2
  • deps: setprototypeof@1.1.0
  • deps: utils-merge@1.0.1

5.0.0-alpha.6 / 2017-09-24

This is the sixth Express 5.0 alpha release, based off 4.15.5 and includes changes from 5.0.0-alpha.5.

• remove:
  • res.redirect(url, status) signature - use res.redirect(status, url)
  • res.send(status, body) signature - use res.status(status).send(body)
• deps: router@~1.3.1
  • deps: debug@2.6.8

5.0.0-alpha.5 / 2017-03-06

This is the fifth Express 5.0 alpha release, based off 4.15.2 and includes changes from 5.0.0-alpha.4.

5.0.0-alpha.4 / 2017-03-01

This is the fourth Express 5.0 alpha release, based off 4.15.0 and includes changes from 5.0.0-alpha.3.

• remove:
  • Remove Express 3.x middleware error stubs
• deps: router@~1.3.0
  • Add next("router") to exit from router
  • Fix case where router.use skipped requests routes did not
  • Skip routing when req.url is not set
  • Use %o in path debug to tell types apart
  • deps: debug@2.6.1
  • deps: setprototypeof@1.0.3
  • perf: add fast match path for * route

5.0.0-alpha.3 / 2017-01-28

This is the third Express 5.0 alpha release, based off 4.14.1 and includes changes from 5.0.0-alpha.2.

• remove:
  • res.json(status, obj) signature - use res.status(status).json(obj)
  • res.jsonp(status, obj) signature - use res.status(status).jsonp(obj)
  • res.vary() (no arguments) -- provide a field name as an argument
• deps: array-flatten@2.1.1
• deps: path-is-absolute@1.0.1
• deps: router@~1.1.5
  • deps: array-flatten@2.0.1
  • deps: methods@~1.1.2
  • deps: parseurl@~1.3.1
  • deps: setprototypeof@1.0.2

5.0.0-alpha.2 / 2015-07-06

This is the second Express 5.0 alpha release, based off 4.13.1 and includes changes from 5.0.0-alpha.1.

• remove:
  • app.param(fn)
  • req.param() -- use req.params, req.body, or req.query instead
• change:
  • res.render callback is always async, even for sync view engines
  • The leading : character in name for app.param(name, fn) is no longer removed
  • Use router module for routing
  • Use path-is-absolute module for absolute path detection

5.0.0-alpha.1 / 2014-11-06

This is the first Express 5.0 alpha release, based off 4.10.1.

• remove:
  • app.del - use app.delete
  • req.acceptsCharset - use req.acceptsCharsets
  • req.acceptsEncoding - use req.acceptsEncodings
  • req.acceptsLanguage - use req.acceptsLanguages
  • res.json(obj, status) signature - use res.json(status, obj)
  • res.jsonp(obj, status) signature - use res.jsonp(status, obj)
  • res.send(body, status) signature - use res.send(status, body)
  • res.send(status) signature - use res.sendStatus(status)
  • res.sendfile - use res.sendFile instead
  • express.query middleware
• change:
  • req.host now returns host (hostname:port) - use req.hostname for only hostname
  • req.query is now a getter instead of a plain property
• add:
  • app.router is a reference to the base router

4.20.0 / 2024-09-10

• deps: serve-static@0.16.0
  • Remove link renderization in html while redirecting
• deps: send@0.19.0
  • Remove link renderization in html while redirecting
• deps: body-parser@0.6.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
• Remove link renderization in html while using res.redirect
• deps: path-to-regexp@0.1.10
  • Adds support for named matching groups in the routes using a regex
  • Adds backtracking protection to parameters without regexes defined
• deps: encodeurl@~2.0.0
  • Removes encoding of \, |, and ^ to align better with URL spec
• Deprecate passing options.maxAge and options.expires to res.clearCookie
  • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

• Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

• Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

• Prevent open redirect allow list bypass due to encodeurl
• deps: cookie@0.6.0

4.18.3 / 2024-02-29

• Fix routing requests without method
• deps: body-parser@1.20.2
  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
  • deps: raw-body@2.5.2
• deps: cookie@0.6.0
  • Add partitioned option

4.18.2 / 2022-10-08

• Fix regression routing a large stack in a single route
• deps: body-parser@1.20.1
  • deps: qs@6.11.0
  • perf: remove unnecessary object clone
• deps: qs@6.11.0

4.18.1 / 2022-04-29

• Fix hanging on large stack of sync routes

4.18.0 / 2022-04-25

• Add "root" option to res.download
• Allow options without filename in res.download
• Deprecate string and non-integer arguments to res.status
• Fix behavior of null/undefined as maxAge in res.cookie
• Fix handling very large stacks of sync middleware
• Ignore Object.prototype values in settings through app.set/app.get
• Invoke default with same arguments as types in res.format
• Support proper 205 responses using res.send
• Use http-errors for res.format error
• deps: body-parser@1.20.0
  • Fix error message for json parse whitespace in strict
  • Fix internal error when inflated body exceeds limit
  • Prevent loss of async hooks context
  • Prevent hanging when request already read
  • deps: depd@2.0.0
  • deps: http-errors@2.0.0
  • deps: on-finished@2.4.1
  • deps: qs@6.10.3
  • deps: raw-body@2.5.1
• deps: cookie@0.5.0
  • Add priority option
  • Fix expires option to reject invalid dates
• deps: depd@2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: finalhandler@1.2.0
  • Remove set content headers that break response
  • deps: on-finished@2.4.1
  • deps: statuses@2.0.1
• deps: on-finished@2.4.1
  • Prevent loss of async hooks context
• deps: qs@6.10.3
• deps: send@0.18.0
  • Fix emitted 416 error missing headers property
  • Limit the headers removed for 304 response
  • deps: depd@2.0.0
  • deps: destroy@1.2.0
  • deps: http-errors@2.0.0
  • deps: on-finished@2.4.1
  • deps: statuses@2.0.1
• deps: serve-static@1.15.0
  • deps: send@0.18.0
• deps: statuses@2.0.1
  • Remove code 306
  • Rename 425 Unordered Collection to standard 425 Too Early

4.17.3 / 2022-02-16

• deps: accepts@~1.3.8
  • deps: mime-types@~2.1.34
  • deps: negotiator@0.6.3
• deps: body-parser@1.19.2
  • deps: bytes@3.1.2
  • deps: qs@6.9.7
  • deps: raw-body@2.4.3
• deps: cookie@0.4.2
• deps: qs@6.9.7
  • Fix handling of __proto__ keys
• pref: remove unnecessary regexp for trust proxy

4.17.2 / 2021-12-16

• Fix handling of undefined in res.jsonp
• Fix handling of undefined when "json escape" is enabled
• Fix incorrect middleware execution with unanchored RegExps
• Fix res.jsonp(obj, status) deprecation message
• Fix typo in res.is JSDoc
• deps: body-parser@1.19.1
  • deps: bytes@3.1.1
  • deps: http-errors@1.8.1
  • deps: qs@6.9.6
  • deps: raw-body@2.4.2
  • deps: safe-buffer@5.2.1
  • deps: type-is@~1.6.18
• deps: content-disposition@0.5.4
  • deps: safe-buffer@5.2.1
• deps: cookie@0.4.1
  • Fix maxAge option to reject invalid values
• deps: proxy-addr@~2.0.7
  • Use req.socket over deprecated req.connection
  • deps: forwarded@0.2.0
  • deps: ipaddr.js@1.9.1
• deps: qs@6.9.6
• deps: safe-buffer@5.2.1
• deps: send@0.17.2
  • deps: http-errors@1.8.1
  • deps: ms@2.1.3
  • pref: ignore empty http tokens
• deps: serve-static@1.14.2
  • deps: send@0.17.2
• deps: setprototypeof@1.2.0

4.17.1 / 2019-05-25

• Revert "Improve error message for null/undefined to res.status"

4.17.0 / 2019-05-16

• Add express.raw to parse bodies into Buffer
• Add express.text to parse bodies into string
• Improve error message for non-strings to res.sendFile
• Improve error message for null/undefined to res.status
• Support multiple hosts in X-Forwarded-Host
• deps: accepts@~1.3.7
• deps: body-parser@1.19.0
  • Add encoding MIK
  • Add petabyte (pb) support
  • Fix parsing array brackets after index
  • deps: bytes@3.1.0
  • deps: http-errors@1.7.2
  • deps: iconv-lite@0.4.24
  • deps: qs@6.7.0
  • deps: raw-body@2.4.0
  • deps: type-is@~1.6.17
• deps: content-disposition@0.5.3
• deps: cookie@0.4.0
  • Add SameSite=None support
• deps: finalhandler@~1.1.2
  • Set stricter Content-Security-Policy header
  • deps: parseurl@~1.3.3
  • deps: statuses@~1.5.0
• deps: parseurl@~1.3.3
• deps: proxy-addr@~2.0.5
  • deps: ipaddr.js@1.9.0
• deps: qs@6.7.0
  • Fix parsing array brackets after index
• deps: range-parser@~1.2.1
• deps: send@0.17.1
  • Set stricter CSP header in redirect & error responses
  • deps: http-errors@~1.7.2
  • deps: mime@1.6.0
  • deps: ms@2.1.1
  • deps: range-parser@~1.2.1
  • deps: statuses@~1.5.0
  • perf: remove redundant path.normalize call
• deps: serve-static@1.14.1
  • Set stricter CSP header in redirect response
  • deps: parseurl@~1.3.3
  • deps: send@0.17.1
• deps: setprototypeof@1.1.1
• deps: statuses@~1.5.0
  • Add 103 Early Hints
• deps: type-is@~1.6.18
  • deps: mime-types@~2.1.24
  • perf: prevent internal throw on invalid type

4.16.4 / 2018-10-10

• Fix issue where "Request aborted" may be logged in res.sendfile
• Fix JSDoc for Router constructor
• deps: body-parser@1.18.3
  • Fix deprecation warnings on Node.js 10+
  • Fix stack trace for strict json parse error
  • deps: depd@~1.1.2
  • deps: http-errors@~1.6.3
  • deps: iconv-lite@0.4.23
  • deps: qs@6.5.2
  • deps: raw-body@2.3.3
  • deps: type-is@~1.6.16
• deps: proxy-addr@~2.0.4
  • deps: ipaddr.js@1.8.0
• deps: qs@6.5.2
• deps: safe-buffer@5.1.2

4.16.3 / 2018-03-12

• deps: accepts@~1.3.5
  • deps: mime-types@~2.1.18
• deps: depd@~1.1.2
  • perf: remove argument reassignment
• deps: encodeurl@~1.0.2
  • Fix encoding % as last character
• deps: finalhandler@1.1.1
  • Fix 404 output for bad / missing pathnames
  • deps: encodeurl@~1.0.2
  • deps: statuses@~1.4.0
• deps: proxy-addr@~2.0.3
  • deps: ipaddr.js@1.6.0
• deps: send@0.16.2
  • Fix incorrect end tag in default error & redirects
  • deps: depd@~1.1.2
  • deps: encodeurl@~1.0.2
  • deps: statuses@~1.4.0
• deps: serve-static@1.13.2
  • Fix incorrect end tag in redirects
  • deps: encodeurl@~1.0.2
  • deps: send@0.16.2
• deps: statuses@~1.4.0
• deps: type-is@~1.6.16
  • deps: mime-types@~2.1.18

4.16.2 / 2017-10-09

• Fix TypeError in res.send when given Buffer and ETag header set
• perf: skip parsing of entire X-Forwarded-Proto header

4.16.1 / 2017-09-29

• deps: send@0.16.1
• deps: serve-static@1.13.1
  • Fix regression when root is incorrectly set to a file
  • deps: send@0.16.1

4.16.0 / 2017-09-28

• Add "json escape" setting for res.json and res.jsonp
• Add express.json and express.urlencoded to parse bodies
• Add options argument to res.download
• Improve error message when autoloading invalid view engine
• Improve error messages when non-function provided as middleware
• Skip Buffer encoding when not generating ETag for small response
• Use safe-buffer for improved Buffer API
• deps: accepts@~1.3.4
  • deps: mime-types@~2.1.16
• deps: content-type@~1.0.4
  • perf: remove argument reassignment
  • perf: skip parameter parsing when no parameters
• deps: etag@~1.8.1
  • perf: replace regular expression with substring
• deps: finalhandler@1.1.0
  • Use res.headersSent when available
• deps: parseurl@~1.3.2
  • perf: reduce overhead for full URLs
  • perf: unroll the "fast-path" RegExp
• deps: proxy-addr@~2.0.2
  • Fix trimming leading / trailing OWS in X-Forwarded-For
  • deps: forwarded@~0.1.2
  • deps: ipaddr.js@1.5.2
  • perf: reduce overhead when no X-Forwarded-For header
• deps: qs@6.5.1
  • Fix parsing & compacting very deep objects
• deps: send@0.16.0
  • Add 70 new types for file extensions
  • Add immutable option
  • Fix missing </html> in default error & redirects
  • Set charset as "UTF-8" for .js and .json
  • Use instance methods on steam to check for listeners
  • deps: mime@1.4.1
  • perf: improve path validation speed
• deps: serve-static@1.13.0
  • Add 70 new types for file extensions
  • Add immutable option
  • Set charset as "UTF-8" for .js and .json
  • deps: send@0.16.0
• deps: setprototypeof@1.1.0
• deps: utils-merge@1.0.1
• deps: vary@~1.1.2
  • perf: improve header token parsing speed
• perf: re-use options object when generating ETags
• perf: remove dead .charset set in res.jsonp

4.15.5 / 2017-09-24

• deps: debug@2.6.9
• deps: finalhandler@~1.0.6
  • deps: debug@2.6.9
  • deps: parseurl@~1.3.2
• deps: fresh@0.5.2
  • Fix handling of modified headers with invalid dates
  • perf: improve ETag match loop
  • perf: improve If-None-Match token parsing
• deps: send@0.15.6
  • Fix handling of modified headers with invalid dates
  • deps: debug@2.6.9
  • deps: etag@~1.8.1
  • deps: fresh@0.5.2
  • perf: improve If-Match token parsing
• deps: serve-static@1.12.6
  • deps: parseurl@~1.3.2
  • deps: send@0.15.6
  • perf: improve slash collapsing

4.15.4 / 2017-08-06

• deps: debug@2.6.8
• deps: depd@~1.1.1
  • Remove unnecessary Buffer loading
• deps: finalhandler@~1.0.4
  • deps: debug@2.6.8
• deps: proxy-addr@~1.1.5
  • Fix array argument being altered
  • deps: ipaddr.js@1.4.0
• deps: qs@6.5.0
• deps: send@0.15.4
  • deps: debug@2.6.8
  • deps: depd@~1.1.1
  • deps: http-errors@~1.6.2
• deps: serve-static@1.12.4
  • deps: send@0.15.4

4.15.3 / 2017-05-16

• Fix error when res.set cannot add charset to Content-Type
• deps: debug@2.6.7
  • Fix DEBUG_MAX_ARRAY_LENGTH
  • deps: ms@2.0.0
• deps: finalhandler@~1.0.3
  • Fix missing </html> in HTML document
  • deps: debug@2.6.7
• deps: proxy-addr@~1.1.4
  • deps: ipaddr.js@1.3.0
• deps: send@0.15.3
  • deps: debug@2.6.7
  • deps: ms@2.0.0
• deps: serve-static@1.12.3
  • deps: send@0.15.3
• deps: type-is@~1.6.15
  • deps: mime-types@~2.1.15
• deps: vary@~1.1.1
  • perf: hoist regular expression

4.15.2 / 2017-03-06

• deps: qs@6.4.0
  • Fix regression parsing keys starting with [

4.15.1 / 2017-03-05

• deps: send@0.15.1
  • Fix issue when Date.parse does not return NaN on invalid date
  • Fix strict violation in broken environments
• deps: serve-static@1.12.1
  • Fix issue when Date.parse does not return NaN on invalid date
  • deps: send@0.15.1

4.15.0 / 2017-03-01

• Add debug message when loading view engine
• Add next("router") to exit from router
• Fix case where router.use skipped requests routes did not
• Remove usage of res._headers private field
  • Improves compatibility with Node.js 8 nightly
• Skip routing when req.url is not set
• Use %o in path debug to tell types apart
• Use Object.create to setup request & response prototypes
• Use setprototypeof module to replace __proto__ setting
• Use statuses instead of http module for status messages
• deps: debug@2.6.1
  • Allow colors in workers
  • Deprecated DEBUG_FD environment variable set to 3 or higher
  • Fix error when running under React Native
  • Use same color for same namespace
  • deps: ms@0.7.2
• deps: etag@~1.8.0
  • Use SHA1 instead of MD5 for ETag hashing
  • Works with FIPS 140-2 OpenSSL configuration
• deps: finalhandler@~1.0.0
  • Fix exception when err cannot be converted to a string
  • Fully URL-encode the pathname in the 404
  • Only include the pathname in the 404 message
  • Send complete HTML document
  • Set Content-Security-Policy: default-src 'self' header
  • deps: debug@2.6.1
• deps: fresh@0.5.0
  • Fix false detection of no-cache request directive
  • Fix incorrect result when If-None-Match has both * and ETags
  • Fix weak ETag matching to match spec
  • perf: delay reading header values until needed
  • perf: enable strict mode
  • perf: hoist regular expressions
  • perf: remove duplicate conditional
  • perf: remove unnecessary boolean coercions
  • perf: skip checking modified time if ETag check failed
  • perf: skip parsing If-None-Match when no ETag header
  • perf: use Date.parse instead of new Date
• deps: qs@6.3.1
  • Fix array parsing from skipping empty values
  • Fix compacting nested arrays
• deps: send@0.15.0
  • Fix false detection of no-cache request directive
  • Fix incorrect result when If-None-Match has both * and ETags
  • Fix weak ETag matching to match spec
  • Remove usage of res._headers private field
  • Support If-Match and If-Unmodified-Since headers
  • Use res.getHeaderNames() when available
  • Use res.headersSent when available
  • deps: debug@2.6.1
  • deps: etag@~1.8.0
  • deps: fresh@0.5.0
  • deps: http-errors@~1.6.1
• deps: serve-static@1.12.0
  • Fix false detection of no-cache request directive
  • Fix incorrect result when If-None-Match has both * and ETags
  • Fix weak ETag matching to match spec
  • Remove usage of res._headers private field
  • Send complete HTML document in redirect response
  • Set default CSP header in redirect response
  • Support If-Match and If-Unmodified-Since headers
  • Use res.getHeaderNames() when available
  • Use res.headersSent when available
  • deps: send@0.15.0
• perf: add fast match path for * route
• perf: improve req.ips performance

4.14.1 / 2017-01-28

• deps: content-disposition@0.5.2
• deps: finalhandler@0.5.1
  • Fix exception when err.headers is not an object
  • deps: statuses@~1.3.1
  • perf: hoist regular expressions
  • perf: remove duplicate validation path
• deps: proxy-addr@~1.1.3
  • deps: ipaddr.js@1.2.0
• deps: send@0.14.2
  • deps: http-errors@~1.5.1
  • deps: ms@0.7.2
  • deps: statuses@~1.3.1
• deps: serve-static@~1.11.2
  • deps: send@0.14.2
• deps: type-is@~1.6.14
  • deps: mime-types@~2.1.13

4.14.0 / 2016-06-16

• Add acceptRanges option to res.sendFile/res.sendfile
• Add cacheControl option to res.sendFile/res.sendfile
• Add options argument to req.range
  • Includes the combine option
• Encode URL in res.location/res.redirect if not already encoded
• Fix some redirect handling in res.sendFile/res.sendfile
• Fix Windows absolute path check using forward slashes
• Improve error with invalid arguments to req.get()
• Improve performance for res.json/res.jsonp in most cases
• Improve Range header handling in res.sendFile/res.sendfile
• deps: accepts@~1.3.3
  • Fix including type extensions in parameters in Accept parsing
  • Fix parsing Accept parameters with quoted equals
  • Fix parsing Accept parameters with quoted semicolons
  • Many performance improvements
  • deps: mime-types@~2.1.11
  • deps: negotiator@0.6.1
• deps: content-type@~1.0.2
  • perf: enable strict mode
• deps: cookie@0.3.1
  • Add sameSite option
  • Fix cookie Max-Age to never be a floating point number
  • Improve error message when encode is not a function
  • Improve error message when expires is not a Date
  • Throw better error for invalid argument to parse
  • Throw on invalid values provided to serialize
  • perf: enable strict mode
  • perf: hoist regular expression
  • perf: use for loop in parse
  • perf: use string concatenation for serialization
• deps: finalhandler@0.5.0
  • Change invalid or non-numeric status code to 500
  • Overwrite status message to match set status code
  • Prefer err.statusCode if err.status is invalid
  • Set response headers from err.headers object
  • Use statuses instead of http module for status messages
• deps: proxy-addr@~1.1.2
  • Fix accepting various invalid netmasks
  • Fix IPv6-mapped IPv4 validation edge cases
  • IPv4 netmasks must be contiguous
  • IPv6 addresses cannot be used as a netmask
  • deps: ipaddr.js@1.1.1
• deps: qs@6.2.0
  • Add decoder option in parse function
• deps: range-parser@~1.2.0
  • Add combine option to combine overlapping ranges
  • Fix incorrectly returning -1 when there is at least one valid range
  • perf: remove internal function
• deps: send@0.14.1
  • Add acceptRanges option
  • Add cacheControl option
  • Attempt to combine multiple ranges into single range
  • Correctly inherit from Stream class
  • Fix Content-Range header in 416 responses when using start/end options
  • Fix Content-Range header missing from default 416 responses
  • Fix redirect error when path contains raw non-URL characters
  • Fix redirect when path starts with multiple forward slashes
  • Ignore non-byte Range headers
  • deps: http-errors@~1.5.0
  • deps: range-parser@~1.2.0
  • deps: statuses@~1.3.0
  • perf: remove argument reassignment
• deps: serve-static@~1.11.1
  • Add acceptRanges option
  • Add cacheControl option
  • Attempt to combine multiple ranges into single range
  • Fix redirect error when req.url contains raw non-URL characters
  • Ignore non-byte Range headers
  • Use status code 301 for redirects
  • deps: send@0.14.1
• deps: type-is@~1.6.13
  • Fix type error when given invalid type to match against
  • deps: mime-types@~2.1.11
• deps: vary@~1.1.0
  • Only accept valid field names in the field argument
• perf: use strict equality when possible

4.13.4 / 2016-01-21

• deps: content-disposition@0.5.1
  • perf: enable strict mode
• deps: cookie@0.1.5
  • Throw on invalid values provided to serialize
• deps: depd@~1.1.0
  • Support web browser loading
  • perf: enable strict mode
• deps: escape-html@~1.0.3
  • perf: enable strict mode
  • perf: optimize string replacement
  • perf: use faster string coercion
• deps: finalhandler@0.4.1
  • deps: escape-html@~1.0.3
• deps: merge-descriptors@1.0.1
  • perf: enable strict mode
• deps: methods@~1.1.2
  • perf: enable strict mode
• deps: parseurl@~1.3.1
  • perf: enable strict mode
• deps: proxy-addr@~1.0.10
  • deps: ipaddr.js@1.0.5
  • perf: enable strict mode
• deps: range-parser@~1.0.3
  • perf: enable strict mode
• deps: send@0.13.1
  • deps: depd@~1.1.0
  • deps: destroy@~1.0.4
  • deps: escape-html@~1.0.3
  • deps: range-parser@~1.0.3
• deps: serve-static@~1.10.2
  • deps: escape-html@~1.0.3
  • deps: parseurl@~1.3.0
  • deps: send@0.13.1

4.13.3 / 2015-08-02

• Fix infinite loop condition using mergeParams: true
• Fix inner numeric indices incorrectly altering parent req.params

4.13.2 / 2015-07-31

• deps: accepts@~1.2.12
  • deps: mime-types@~2.1.4
• deps: array-flatten@1.1.1
  • perf: enable strict mode
• deps: path-to-regexp@0.1.7
  • Fix regression with escaped round brackets and matching groups
• deps: type-is@~1.6.6
  • deps: mime-types@~2.1.4

4.13.1 / 2015-07-05

• deps: accepts@~1.2.10
  • deps: mime-types@~2.1.2
• deps: qs@4.0.0
  • Fix dropping parameters like hasOwnProperty
  • Fix various parsing edge cases
• deps: type-is@~1.6.4
  • deps: mime-types@~2.1.2
  • perf: enable strict mode
  • perf: remove argument reassignment

4.13.0 / 2015-06-20

• Add settings to debug output
• Fix res.format error when only default provided
• Fix issue where next('route') in app.param would incorrectly skip values
• Fix hiding platform issues with decodeURIComponent
  • Only URIErrors are a 400
• Fix using * before params in routes
• Fix using capture groups before params in routes
• Simplify res.cookie to call res.append
• Use array-flatten module for flattening arrays
• deps: accepts@~1.2.9
  • deps: mime-types@~2.1.1
  • perf: avoid argument reassignment & argument slice
  • perf: avoid negotiator recursive construction
  • perf: enable strict mode
  • perf: remove unnecessary bitwise operator
• deps: cookie@0.1.3
  • perf: deduce the scope of try-catch deopt
  • perf: remove argument reassignments
• deps: escape-html@1.0.2
• deps: etag@~1.7.0
  • Always include entity length in ETags for hash length extensions
  • Generate non-Stats ETags using MD5 only (no longer CRC32)
  • Improve stat performance by removing hashing
  • Improve support for JXcore
  • Remove base64 padding in ETags to shorten
  • Support "fake" stats objects in environments without fs
  • Use MD5 instead of MD4 in weak ETags over 1KB
• deps: finalhandler@0.4.0
  • Fix a false-positive when unpiping in Node.js 0.8
  • Support statusCode property on Error objects
  • Use unpipe module for unpiping requests
  • deps: escape-html@1.0.2
  • deps: on-finished@~2.3.0
  • perf: enable strict mode
  • perf: remove argument reassignment
• deps: fresh@0.3.0
  • Add weak ETag matching support
• deps: on-finished@~2.3.0
  • Add defined behavior for HTTP CONNECT requests
  • Add defined behavior for HTTP Upgrade requests
  • deps: ee-first@1.1.1
• deps: path-to-regexp@0.1.6
• deps: send@0.13.0
  • Allow Node.js HTTP server to set Date response header
  • Fix incorrectly removing Content-Location on 304 response
  • Improve the default redirect response headers
  • Send appropriate headers on default error response
  • Use http-errors for standard emitted errors
  • Use statuses instead of http module for status messages
  • deps: escape-html@1.0.2
  • deps: etag@~1.7.0
  • deps: fresh@0.3.0
  • deps: on-finished@~2.3.0
  • perf: enable strict mode
  • perf: remove unnecessary array allocations
• deps: serve-static@~1.10.0
  • Add fallthrough option
  • Fix reading options from options prototype
  • Improve the default redirect response headers
  • Malformed URLs now next() instead of 400
  • deps: escape-html@1.0.2
  • deps: send@0.13.0
  • perf: enable strict mode
  • perf: remove argument reassignment
• deps: type-is@~1.6.3
  • deps: mime-types@~2.1.1
  • perf: reduce try block size
  • perf: remove bitwise operations
• perf: enable strict mode
• perf: isolate app.render try block
• perf: remove argument reassignments in application
• perf: remove argument reassignments in request prototype
• perf: remove argument reassignments in response prototype
• perf: remove argument reassignments in routing
• perf: remove argument reassignments in View
• perf: skip attempting to decode zero length string
• perf: use saved reference to http.STATUS_CODES

4.12.4 / 2015-05-17

• deps: accepts@~1.2.7
  • deps: mime-types@~2.0.11
  • deps: negotiator@0.5.3
• deps: debug@~2.2.0
  • deps: ms@0.7.1
• deps: depd@~1.0.1
• deps: etag@~1.6.0
  • Improve support for JXcore
  • Support "fake" stats objects in environments without fs
• deps: finalhandler@0.3.6
  • deps: debug@~2.2.0
  • deps: on-finished@~2.2.1
• deps: on-finished@~2.2.1
  • Fix isFinished(req) when data buffered
• deps: proxy-addr@~1.0.8
  • deps: ipaddr.js@1.0.1
• deps: qs@2.4.2

• Fix allowing parameters like constructor

• deps: send@0.12.3
  • deps: debug@~2.2.0
  • deps: depd@~1.0.1
  • deps: etag@~1.6.0
  • deps: ms@0.7.1
  • deps: on-finished@~2.2.1
• deps: serve-static@~1.9.3
  • deps: send@0.12.3
• deps: type-is@~1.6.2
  • deps: mime-types@~2.0.11

4.12.3 / 2015-03-17

• deps: accepts@~1.2.5
  • deps: mime-types@~2.0.10
• deps: debug@~2.1.3
  • Fix high intensity foreground color for bold
  • deps: ms@0.7.0
• deps: finalhandler@0.3.4
  • deps: debug@~2.1.3
• deps: proxy-addr@~1.0.7
  • deps: ipaddr.js@0.1.9
• deps: qs@2.4.1
  • Fix error when parameter hasOwnProperty is present
• deps: send@0.12.2
  • Throw errors early for invalid extensions or index options
  • deps: debug@~2.1.3
• deps: serve-static@~1.9.2
  • deps: send@0.12.2
• deps: type-is@~1.6.1
  • deps: mime-types@~2.0.10

4.12.2 / 2015-03-02

• Fix regression where "Request aborted" is logged using res.sendFile

4.12.1 / 2015-03-01

• Fix constructing application with non-configurable prototype properties
• Fix ECONNRESET errors from res.sendFile usage
• Fix req.host when using "trust proxy" hops count
• Fix req.protocol/req.secure when using "trust proxy" hops count
• Fix wrong code on aborted connections from res.sendFile
• deps: merge-descriptors@1.0.0

4.12.0 / 2015-02-23

• Fix "trust proxy" setting to inherit when app is mounted
• Generate ETags for all request responses
  • No longer restricted to only responses for GET and HEAD requests
• Use content-type to parse Content-Type headers
• deps: accepts@~1.2.4
  • Fix preference sorting to be stable for long acceptable lists
  • deps: mime-types@~2.0.9
  • deps: negotiator@0.5.1
• deps: cookie-signature@1.0.6
• deps: send@0.12.1
  • Always read the stat size from the file
  • Fix mutating passed-in options
  • deps: mime@1.3.4
• deps: serve-static@~1.9.1
  • deps: send@0.12.1
• deps: type-is@~1.6.0
  • fix argument reassignment
  • fix false-positives in hasBody Transfer-Encoding check
  • support wildcard for both type and subtype (*/*)
  • deps: mime-types@~2.0.9

4.11.2 / 2015-02-01

• Fix res.redirect double-calling res.end for HEAD requests
• deps: accepts@~1.2.3
  • deps: mime-types@~2.0.8
• deps: proxy-addr@~1.0.6
  • deps: ipaddr.js@0.1.8
• deps: type-is@~1.5.6
  • deps: mime-types@~2.0.8

4.11.1 / 2015-01-20

• deps: send@0.11.1
  • Fix root path disclosure
• deps: serve-static@~1.8.1
  • Fix redirect loop in Node.js 0.11.14
  • Fix root path disclosure
  • deps: send@0.11.1

4.11.0 / 2015-01-13

• Add res.append(field, val) to append headers
• Deprecate leading : in name for app.param(name, fn)
• Deprecate req.param() -- use req.params, req.body, or req.query instead
• Deprecate app.param(fn)
• Fix OPTIONS responses to include the HEAD method properly
• Fix res.sendFile not always detecting aborted connection
• Match routes iteratively to prevent stack overflows
• deps: accepts@~1.2.2
  • deps: mime-types@~2.0.7
  • deps: negotiator@0.5.0
• deps: send@0.11.0
  • deps: debug@~2.1.1
  • deps: etag@~1.5.1
  • deps: ms@0.7.0
  • deps: on-finished@~2.2.0
• deps: serve-static@~1.8.0
  • deps: send@0.11.0

4.10.8 / 2015-01-13

• Fix crash from error within OPTIONS response handler
• deps: proxy-addr@~1.0.5
  • deps: ipaddr.js@0.1.6

4.10.7 / 2015-01-04

• Fix Allow header for OPTIONS to not contain duplicate methods
• Fix incorrect "Request aborted" for res.sendFile when HEAD or 304
• deps: debug@~2.1.1
• deps: finalhandler@0.3.3
  • deps: debug@~2.1.1
  • deps: on-finished@~2.2.0
• deps: methods@~1.1.1
• deps: on-finished@~2.2.0
• deps: serve-static@~1.7.2
  • Fix potential open redirect when mounted at root
• deps: type-is@~1.5.5
  • deps: mime-types@~2.0.7

4.10.6 / 2014-12-12

• Fix exception in req.fresh/req.stale without response headers

4.10.5 / 2014-12-10

• Fix res.send double-calling res.end for HEAD requests
• deps: accepts@~1.1.4
  • deps: mime-types@~2.0.4
• deps: type-is@~1.5.4
  • deps: mime-types@~2.0.4

4.10.4 / 2014-11-24

• Fix res.sendfile logging standard write errors

4.10.3 / 2014-11-23

• Fix res.sendFile logging standard write errors
• deps: etag@~1.5.1
• deps: proxy-addr@~1.0.4
  • deps: ipaddr.js@0.1.5
• deps: qs@2.3.3
  • Fix arrayLimit behavior

4.10.2 / 2014-11-09

• Correctly invoke async router callback asynchronously
• deps: accepts@~1.1.3
  • deps: mime-types@~2.0.3
• deps: type-is@~1.5.3
  • deps: mime-types@~2.0.3

4.10.1 / 2014-10-28

• Fix handling of URLs containing :// in the path
• deps: qs@2.3.2
  • Fix parsing of mixed objects and values

4.10.0 / 2014-10-23

• Add support for app.set('views', array)
  • Views are looked up in sequence in array of directories
• Fix res.send(status) to mention res.sendStatus(status)
• Fix handling of invalid empty URLs
• Use content-disposition module for res.attachment/res.download
  • Sends standards-compliant Content-Disposition header
  • Full Unicode support
• Use path.resolve in view lookup
• deps: debug@~2.1.0
  • Implement DEBUG_FD env variable support
• deps: depd@~1.0.0
• deps: etag@~1.5.0
  • Improve string performance
  • Slightly improve speed for weak ETags over 1KB
• deps: finalhandler@0.3.2
  • Terminate in progress response only on error
  • Use on-finished to determine request status
  • deps: debug@~2.1.0
  • deps: on-finished@~2.1.1
• deps: on-finished@~2.1.1
  • Fix handling of pipelined requests
• deps: qs@2.3.0
  • Fix parsing of mixed implicit and explicit arrays
• deps: send@0.10.1
  • deps: debug@~2.1.0
  • deps: depd@~1.0.0
  • deps: etag@~1.5.0
  • deps: on-finished@~2.1.1
• deps: serve-static@~1.7.1
  • deps: send@0.10.1

4.9.8 / 2014-10-17

• Fix res.redirect body when redirect status specified
• deps: accepts@~1.1.2
  • Fix error when media type has invalid parameter
  • deps: negotiator@0.4.9

4.9.7 / 2014-10-10

• Fix using same param name in array of paths

4.9.6 / 2014-10-08

• deps: accepts@~1.1.1
  • deps: mime-types@~2.0.2
  • deps: negotiator@0.4.8
• deps: serve-static@~1.6.4
  • Fix redirect loop when index file serving disabled
• deps: type-is@~1.5.2
  • deps: mime-types@~2.0.2

4.9.5 / 2014-09-24

• deps: etag@~1.4.0
• deps: proxy-addr@~1.0.3
  • Use forwarded npm module
• deps: send@0.9.3
  • deps: etag@~1.4.0
• deps: serve-static@~1.6.3
  • deps: send@0.9.3

4.9.4 / 2014-09-19

• deps: qs@2.2.4
  • Fix issue with object keys starting with numbers truncated

4.9.3 / 2014-09-18

• deps: proxy-addr@~1.0.2
  • Fix a global leak when multiple subnets are trusted
  • deps: ipaddr.js@0.1.3

4.9.2 / 2014-09-17

• Fix regression for empty string path in app.use
• Fix router.use to accept array of middleware without path
• Improve error message for bad app.use arguments

4.9.1 / 2014-09-16

• Fix app.use to accept array of middleware without path
• deps: depd@0.4.5
• deps: etag@~1.3.1
• deps: send@0.9.2
  • deps: depd@0.4.5
  • deps: etag@~1.3.1
  • deps: range-parser@~1.0.2
• deps: serve-static@~1.6.2
  • deps: send@0.9.2

4.9.0 / 2014-09-08

• Add res.sendStatus
• Invoke callback for sendfile when client aborts
  • Applies to res.sendFile, res.sendfile, and res.download
  • err will be populated with request aborted error
• Support IP address host in req.subdomains
• Use etag to generate ETag headers
• deps: accepts@~1.1.0
  • update mime-types
• deps: cookie-signature@1.0.5
• deps: debug@~2.0.0
• deps: finalhandler@0.2.0
  • Set X-Content-Type-Options: nosniff header
  • deps: debug@~2.0.0
• deps: fresh@0.2.4
• deps: media-typer@0.3.0
  • Throw error when parameter format invalid on parse
• deps: qs@2.2.3
  • Fix issue where first empty value in array is discarded
• deps: range-parser@~1.0.2
• deps: send@0.9.1
  • Add lastModified option
  • Use etag to generate ETag header
  • deps: debug@~2.0.0
  • deps: fresh@0.2.4
• deps: serve-static@~1.6.1
  • Add lastModified option
  • deps: send@0.9.1
• deps: type-is@~1.5.1
  • fix hasbody to be true for content-length: 0
  • deps: media-typer@0.3.0
  • deps: mime-types@~2.0.1
• deps: vary@~1.0.0
  • Accept valid Vary header string as field

4.8.8 / 2014-09-04

• deps: send@0.8.5
  • Fix a path traversal issue when using root
  • Fix malicious path detection for empty string path
• deps: serve-static@~1.5.4
  • deps: send@0.8.5

4.8.7 / 2014-08-29

• deps: qs@2.2.2
  • Remove unnecessary cloning

4.8.6 / 2014-08-27

• deps: qs@2.2.0
  • Array parsing fix
  • Performance improvements

4.8.5 / 2014-08-18

• deps: send@0.8.3
  • deps: destroy@1.0.3
  • deps: on-finished@2.1.0
• deps: serve-static@~1.5.3
  • deps: send@0.8.3

4.8.4 / 2014-08-14

• deps: qs@1.2.2
• deps: send@0.8.2
  • Work around fd leak in Node.js 0.10 for fs.ReadStream
• deps: serve-static@~1.5.2
  • deps: send@0.8.2

4.8.3 / 2014-08-10

• deps: parseurl@~1.3.0
• deps: qs@1.2.1
• deps: serve-static@~1.5.1
  • Fix parsing of weird req.originalUrl values
  • deps: parseurl@~1.3.0
  • deps: utils-merge@1.0.0

4.8.2 / 2014-08-07

• deps: qs@1.2.0
  • Fix parsing array of objects

4.8.1 / 2014-08-06

• fix incorrect deprecation warnings on res.download
• deps: qs@1.1.0
  • Accept urlencoded square brackets
  • Accept empty values in implicit array notation

4.8.0 / 2014-08-05

• add res.sendFile
  • accepts a file system path instead of a URL
  • requires an absolute path or root option specified
• deprecate res.sendfile -- use res.sendFile instead
• support mounted app as any argument to app.use()
• deps: qs@1.0.2
  • Complete rewrite
  • Limits array length to 20
  • Limits object depth to 5
  • Limits parameters to 1,000
• deps: send@0.8.1
  • Add extensions option
• deps: serve-static@~1.5.0
  • Add extensions option
  • deps: send@0.8.1

4.7.4 / 2014-08-04

• fix res.sendfile regression for serving directory index files
• deps: send@0.7.4
  • Fix incorrect 403 on Windows and Node.js 0.11
  • Fix serving index files without root dir
• deps: serve-static@~1.4.4
  • deps: send@0.7.4

4.7.3 / 2014-08-04

• deps: send@0.7.3
  • Fix incorrect 403 on Windows and Node.js 0.11
• deps: serve-static@~1.4.3
  • Fix incorrect 403 on Windows and Node.js 0.11
  • deps: send@0.7.3

4.7.2 / 2014-07-27

• deps: depd@0.4.4
  • Work-around v8 generating empty stack traces
• deps: send@0.7.2
  • deps: depd@0.4.4
• deps: serve-static@~1.4.2

4.7.1 / 2014-07-26

• deps: depd@0.4.3
  • Fix exception when global Error.stackTraceLimit is too low
• deps: send@0.7.1
  • deps: depd@0.4.3
• deps: serve-static@~1.4.1

4.7.0 / 2014-07-25

• fix req.protocol for proxy-direct connections
• configurable query parser with app.set('query parser', parser)
  • app.set('query parser', 'extended') parse with "qs" module
  • app.set('query parser', 'simple') parse with "querystring" core module
  • app.set('query parser', false) disable query string parsing
  • app.set('query parser', true) enable simple parsing
• deprecate res.json(status, obj) -- use res.status(status).json(obj) instead
• deprecate res.jsonp(status, obj) -- use res.status(status).jsonp(obj) instead
• deprecate res.send(status, body) -- use res.status(status).send(body) instead
• deps: debug@1.0.4
• deps: depd@0.4.2
  • Add TRACE_DEPRECATION environment variable
  • Remove non-standard grey color from color output
  • Support --no-deprecation argument
  • Support --trace-deprecation argument
• deps: finalhandler@0.1.0
  • Respond after request fully read
  • deps: debug@1.0.4
• deps: parseurl@~1.2.0
  • Cache URLs based on original value
  • Remove no-longer-needed URL mis-parse work-around
  • Simplify the "fast-path" RegExp
• deps: send@0.7.0
  • Add dotfiles option
  • Cap maxAge value to 1 year
  • deps: debug@1.0.4
  • deps: depd@0.4.2
• deps: serve-static@~1.4.0
  • deps: parseurl@~1.2.0
  • deps: send@0.7.0
• perf: prevent multiple Buffer creation in res.send

4.6.1 / 2014-07-12

• fix subapp.mountpath regression for app.use(subapp)

4.6.0 / 2014-07-11

• accept multiple callbacks to app.use()
• add explicit "Rosetta Flash JSONP abuse" protection
  • previous versions are not vulnerable; this is just explicit protection
• catch errors in multiple req.param(name, fn) handlers
• deprecate res.redirect(url, status) -- use res.redirect(status, url) instead
• fix res.send(status, num) to send num as json (not error)
• remove unnecessary escaping when res.jsonp returns JSON response
• support non-string path in app.use(path, fn)
  • supports array of paths
  • supports RegExp
• router: fix optimization on router exit
• router: refactor location of try blocks
• router: speed up standard app.use(fn)
• deps: debug@1.0.3
  • Add support for multiple wildcards in namespaces
• deps: finalhandler@0.0.3
  • deps: debug@1.0.3
• deps: methods@1.1.0
  • add CONNECT
• deps: parseurl@~1.1.3
  • faster parsing of href-only URLs
• deps: path-to-regexp@0.1.3
• deps: send@0.6.0
  • deps: debug@1.0.3
• deps: serve-static@~1.3.2
  • deps: parseurl@~1.1.3
  • deps: send@0.6.0
• perf: fix arguments reassign deopt in some res methods

4.5.1 / 2014-07-06

• fix routing regression when altering req.method

4.5.0 / 2014-07-04

• add deprecation message to non-plural req.accepts*
• add deprecation message to res.send(body, status)
• add deprecation message to res.vary()
• add headers option to res.sendfile
  • use to set headers on successful file transfer
• add mergeParams option to Router
  • merges req.params from parent routes
• add req.hostname -- correct name for what req.host returns
• deprecate things with depd module
• deprecate req.host -- use req.hostname instead
• fix behavior when handling request without routes
• fix handling when route.all is only route
• invoke router.param() only when route matches
• restore req.params after invoking router
• use finalhandler for final response handling
• use media-typer to alter content-type charset
• deps: accepts@~1.0.7
• deps: send@0.5.0
  • Accept string for maxage (converted by ms)
  • Include link in default redirect response
• deps: serve-static@~1.3.0
  • Accept string for maxAge (converted by ms)
  • Add setHeaders option
  • Include HTML link in redirect response
  • deps: send@0.5.0
• deps: type-is@~1.3.2

4.4.5 / 2014-06-26

• deps: cookie-signature@1.0.4
  • fix for timing attacks

4.4.4 / 2014-06-20

• fix res.attachment Unicode filenames in Safari
• fix "trim prefix" debug message in express:router
• deps: accepts@~1.0.5
• deps: buffer-crc32@0.2.3

4.4.3 / 2014-06-11

• fix persistence of modified req.params[name] from app.param()
• deps: accepts@1.0.3
  • deps: negotiator@0.4.6
• deps: debug@1.0.2
• deps: send@0.4.3
  • Do not throw uncatchable error on file open race condition
  • Use escape-html for HTML escaping
  • deps: debug@1.0.2
  • deps: finished@1.2.2
  • deps: fresh@0.2.2
• deps: serve-static@1.2.3
  • Do not throw uncatchable error on file open race condition
  • deps: send@0.4.3

4.4.2 / 2014-06-09

• fix catching errors from top-level handlers
• use vary module for res.vary
• deps: debug@1.0.1
• deps: proxy-addr@1.0.1
• deps: send@0.4.2
  • fix "event emitter leak" warnings
  • deps: debug@1.0.1
  • deps: finished@1.2.1
• deps: serve-static@1.2.2
  • fix "event emitter leak" warnings
  • deps: send@0.4.2
• deps: type-is@1.2.1

4.4.1 / 2014-06-02

• deps: methods@1.0.1
• deps: send@0.4.1
  • Send max-age in Cache-Control in correct format
• deps: serve-static@1.2.1
  • use escape-html for escaping
  • deps: send@0.4.1

4.4.0 / 2014-05-30

• custom etag control with app.set('etag', val)
  • app.set('etag', function(body, encoding){ return '"etag"' }) custom etag generation
  • app.set('etag', 'weak') weak tag
  • app.set('etag', 'strong') strong etag
  • app.set('etag', false) turn off
  • app.set('etag', true) standard etag
• mark res.send ETag as weak and reduce collisions
• update accepts to 1.0.2
  • Fix interpretation when header not in request
• update send to 0.4.0
  • Calculate ETag with md5 for reduced collisions
  • Ignore stream errors after request ends
  • deps: debug@0.8.1
• update serve-static to 1.2.0
  • Calculate ETag with md5 for reduced collisions
  • Ignore stream errors after request ends
  • deps: send@0.4.0

4.3.2 / 2014-05-28

• fix handling of errors from router.param() callbacks

4.3.1 / 2014-05-23

• revert "fix behavior of multiple app.VERB for the same path"
  • this caused a regression in the order of route execution

4.3.0 / 2014-05-21

• add req.baseUrl to access the path stripped from req.url in routes
• fix behavior of multiple app.VERB for the same path
• fix issue routing requests among sub routers
• invoke router.param() only when necessary instead of every match
• proper proxy trust with app.set('trust proxy', trust)
  • app.set('trust proxy', 1) trust first hop
  • app.set('trust proxy', 'loopback') trust loopback addresses
  • app.set('trust proxy', '10.0.0.1') trust single IP
  • app.set('trust proxy', '10.0.0.1/16') trust subnet
  • app.set('trust proxy', '10.0.0.1, 10.0.0.2') trust list
  • app.set('trust proxy', false) turn off
  • app.set('trust proxy', true) trust everything
• set proper charset in Content-Type for res.send
• update type-is to 1.2.0
  • support suffix matching

4.2.0 / 2014-05-11

• deprecate app.del() -- use app.delete() instead
• deprecate res.json(obj, status) -- use res.json(status, obj) instead
  • the edge-case res.json(status, num) requires res.status(status).json(num)
• deprecate res.jsonp(obj, status) -- use res.jsonp(status, obj) instead
  • the edge-case res.jsonp(status, num) requires res.status(status).jsonp(num)
• fix req.next when inside router instance
• include ETag header in HEAD requests
• keep previous Content-Type for res.jsonp
• support PURGE method
  • add app.purge
  • add router.purge
  • include PURGE in app.all
• update debug to 0.8.0
  • add enable() method
  • change from stderr to stdout
• update methods to 1.0.0
  • add PURGE

4.1.2 / 2014-05-08

• fix req.host for IPv6 literals
• fix res.jsonp error if callback param is object

4.1.1 / 2014-04-27

• fix package.json to reflect supported node version

4.1.0 / 2014-04-24

• pass options from res.sendfile to send
• preserve casing of headers in res.header and res.set
• support unicode file names in res.attachment and res.download
• update accepts to 1.0.1
  • deps: negotiator@0.4.0
• update cookie to 0.1.2
  • Fix for maxAge == 0
  • made compat with expires field
• update send to 0.3.0
  • Accept API options in options object
  • Coerce option types
  • Control whether to generate etags
  • Default directory access to 403 when index disabled
  • Fix sending files with dots without root set
  • Include file path in etag
  • Make "Can't set headers after they are sent." catchable
  • Send full entity-body for multi range requests
  • Set etags to "weak"
  • Support "If-Range" header
  • Support multiple index paths
  • deps: mime@1.2.11
• update serve-static to 1.1.0
  • Accept options directly to send module
  • Resolve relative paths at middleware setup
  • Use parseurl to parse the URL from request
  • deps: send@0.3.0
• update type-is to 1.1.0
  • add non-array values support
  • add multipart as a shorthand

4.0.0 / 2014-04-09

• remove:
  • node 0.8 support
  • connect and connect's patches except for charset handling
  • express(1) - moved to express-generator
  • express.createServer() - it has been deprecated for a long time. Use express()
  • app.configure - use logic in your own app code
  • app.router - is removed
  • req.auth - use basic-auth instead
  • req.accepted* - use req.accepts*() instead
  • res.location - relative URL resolution is removed
  • res.charset - include the charset in the content type when using res.set()
  • all bundled middleware except static
• change:
  • app.route -> app.mountpath when mounting an express app in another express app
  • json spaces no longer enabled by default in development
  • req.accepts* -> req.accepts*s - i.e. req.acceptsEncoding -> req.acceptsEncodings
  • req.params is now an object instead of an array
  • res.locals is no longer a function. It is a plain js object. Treat it as such.
  • res.headerSent -> res.headersSent to match node.js ServerResponse object
• refactor:
  • req.accepts* with accepts
  • req.is with type-is
  • path-to-regexp
• add:
  • app.router() - returns the app Router instance
  • app.route() - Proxy to the app's Router#route() method to create a new route
  • Router & Route - public API

3.21.2 / 2015-07-31

• deps: connect@2.30.2
  • deps: body-parser@~1.13.3
  • deps: compression@~1.5.2
  • deps: errorhandler@~1.4.2
  • deps: method-override@~2.3.5
  • deps: serve-index@~1.7.2
  • deps: type-is@~1.6.6
  • deps: vhost@~3.0.1
• deps: vary@~1.0.1
  • Fix setting empty header from empty field
  • perf: enable strict mode
  • perf: remove argument reassignments

3.21.1 / 2015-07-05

• deps: basic-auth@~1.0.3
• deps: connect@2.30.1
  • deps: body-parser@~1.13.2
  • deps: compression@~1.5.1
  • deps: errorhandler@~1.4.1
  • deps: morgan@~1.6.1
  • deps: pause@0.1.0
  • deps: qs@4.0.0
  • deps: serve-index@~1.7.1
  • deps: type-is@~1.6.4

3.21.0 / 2015-06-18

• deps: basic-auth@1.0.2
  • perf: enable strict mode
  • perf: hoist regular expression
  • perf: parse with regular expressions
  • perf: remove argument reassignment
• deps: connect@2.30.0
  • deps: body-parser@~1.13.1
  • deps: bytes@2.1.0
  • deps: compression@~1.5.0
  • deps: cookie@0.1.3
  • deps: cookie-parser@~1.3.5
  • deps: csurf@~1.8.3
  • deps: errorhandler@~1.4.0
  • deps: express-session@~1.11.3
  • deps: finalhandler@0.4.0
  • deps: fresh@0.3.0
  • deps: morgan@~1.6.0
  • deps: serve-favicon@~2.3.0
  • deps: serve-index@~1.7.0
  • deps: serve-static@~1.10.0
  • deps: type-is@~1.6.3
• deps: cookie@0.1.3
  • perf: deduce the scope of try-catch deopt
  • perf: remove argument reassignments
• deps: escape-html@1.0.2
• deps: etag@~1.7.0
  • Always include entity length in ETags for hash length extensions
  • Generate non-Stats ETags using MD5 only (no longer CRC32)
  • Improve stat performance by removing hashing
  • Improve support for JXcore
  • Remove base64 padding in ETags to shorten
  • Support "fake" stats objects in environments without fs
  • Use MD5 instead of MD4 in weak ETags over 1KB
• deps: fresh@0.3.0
  • Add weak ETag matching support
• deps: mkdirp@0.5.1
  • Work in global strict mode
• deps: send@0.13.0
  • Allow Node.js HTTP server to set Date response header
  • Fix incorrectly removing Content-Location on 304 response
  • Improve the default redirect response headers
  • Send appropriate headers on default error response
  • Use http-errors for standard emitted errors
  • Use statuses instead of http module for status messages
  • deps: escape-html@1.0.2
  • deps: etag@~1.7.0
  • deps: fresh@0.3.0
  • deps: on-finished@~2.3.0
  • perf: enable strict mode
  • perf: remove unnecessary array allocations

3.20.3 / 2015-05-17

• deps: connect@2.29.2
  • deps: body-parser@~1.12.4
  • deps: compression@~1.4.4
  • deps: connect-timeout@~1.6.2
  • deps: debug@~2.2.0
  • deps: depd@~1.0.1
  • deps: errorhandler@~1.3.6
  • deps: finalhandler@0.3.6
  • deps: method-override@~2.3.3
  • deps: morgan@~1.5.3
  • deps: qs@2.4.2
  • deps: response-time@~2.3.1
  • deps: serve-favicon@~2.2.1
  • deps: serve-index@~1.6.4
  • deps: serve-static@~1.9.3
  • deps: type-is@~1.6.2
• deps: debug@~2.2.0
  • deps: ms@0.7.1
• deps: depd@~1.0.1
• deps: proxy-addr@~1.0.8
  • deps: ipaddr.js@1.0.1
• deps: send@0.12.3
  • deps: debug@~2.2.0
  • deps: depd@~1.0.1
  • deps: etag@~1.6.0
  • deps: ms@0.7.1
  • deps: on-finished@~2.2.1

3.20.2 / 2015-03-16

• deps: connect@2.29.1
  • deps: body-parser@~1.12.2
  • deps: compression@~1.4.3
  • deps: connect-timeout@~1.6.1
  • deps: debug@~2.1.3
  • deps: errorhandler@~1.3.5
  • deps: express-session@~1.10.4
  • deps: finalhandler@0.3.4
  • deps: method-override@~2.3.2
  • deps: morgan@~1.5.2
  • deps: qs@2.4.1
  • deps: serve-index@~1.6.3
  • deps: serve-static@~1.9.2
  • deps: type-is@~1.6.1
• deps: debug@~2.1.3
  • Fix high intensity foreground color for bold
  • deps: ms@0.7.0
• deps: merge-descriptors@1.0.0
• deps: proxy-addr@~1.0.7
  • deps: ipaddr.js@0.1.9
• deps: send@0.12.2
  • Throw errors early for invalid extensions or index options
  • deps: debug@~2.1.3

3.20.1 / 2015-02-28

• Fix req.host when using "trust proxy" hops count
• Fix req.protocol/req.secure when using "trust proxy" hops count

3.20.0 / 2015-02-18

• Fix "trust proxy" setting to inherit when app is mounted
• Generate ETags for all request responses
  • No longer restricted to only responses for GET and HEAD requests
• Use content-type to parse Content-Type headers
• deps: connect@2.29.0
  • Use content-type to parse Content-Type headers
  • deps: body-parser@~1.12.0
  • deps: compression@~1.4.1
  • deps: connect-timeout@~1.6.0
  • deps: cookie-parser@~1.3.4
  • deps: cookie-signature@1.0.6
  • deps: csurf@~1.7.0
  • deps: errorhandler@~1.3.4
  • deps: express-session@~1.10.3
  • deps: http-errors@~1.3.1
  • deps: response-time@~2.3.0
  • deps: serve-index@~1.6.2
  • deps: serve-static@~1.9.1
  • deps: type-is@~1.6.0
• deps: cookie-signature@1.0.6
• deps: send@0.12.1
  • Always read the stat size from the file
  • Fix mutating passed-in options
  • deps: mime@1.3.4

3.19.2 / 2015-02-01

• deps: connect@2.28.3
  • deps: compression@~1.3.1
  • deps: csurf@~1.6.6
  • deps: errorhandler@~1.3.3
  • deps: express-session@~1.10.2
  • deps: serve-index@~1.6.1
  • deps: type-is@~1.5.6
• deps: proxy-addr@~1.0.6
  • deps: ipaddr.js@0.1.8

3.19.1 / 2015-01-20

• deps: connect@2.28.2
  • deps: body-parser@~1.10.2
  • deps: serve-static@~1.8.1
• deps: send@0.11.1
  • Fix root path disclosure

3.19.0 / 2015-01-09

• Fix OPTIONS responses to include the HEAD method property
• Use readline for prompt in express(1)
• deps: commander@2.6.0
• deps: connect@2.28.1
  • deps: body-parser@~1.10.1
  • deps: compression@~1.3.0
  • deps: connect-timeout@~1.5.0
  • deps: csurf@~1.6.4
  • deps: debug@~2.1.1
  • deps: errorhandler@~1.3.2
  • deps: express-session@~1.10.1
  • deps: finalhandler@0.3.3
  • deps: method-override@~2.3.1
  • deps: morgan@~1.5.1
  • deps: serve-favicon@~2.2.0
  • deps: serve-index@~1.6.0
  • deps: serve-static@~1.8.0
  • deps: type-is@~1.5.5
• deps: debug@~2.1.1
• deps: methods@~1.1.1
• deps: proxy-addr@~1.0.5
  • deps: ipaddr.js@0.1.6
• deps: send@0.11.0
  • deps: debug@~2.1.1
  • deps: etag@~1.5.1
  • deps: ms@0.7.0
  • deps: on-finished@~2.2.0

3.18.6 / 2014-12-12

• Fix exception in req.fresh/req.stale without response headers

3.18.5 / 2014-12-11

• deps: connect@2.27.6
  • deps: compression@~1.2.2
  • deps: express-session@~1.9.3
  • deps: http-errors@~1.2.8
  • deps: serve-index@~1.5.3
  • deps: type-is@~1.5.4

3.18.4 / 2014-11-23

• deps: connect@2.27.4
  • deps: body-parser@~1.9.3
  • deps: compression@~1.2.1
  • deps: errorhandler@~1.2.3
  • deps: express-session@~1.9.2
  • deps: qs@2.3.3
  • deps: serve-favicon@~2.1.7
  • deps: serve-static@~1.5.1
  • deps: type-is@~1.5.3
• deps: etag@~1.5.1
• deps: proxy-addr@~1.0.4
  • deps: ipaddr.js@0.1.5

3.18.3 / 2014-11-09

• deps: connect@2.27.3
  • Correctly invoke async callback asynchronously
  • deps: csurf@~1.6.3

3.18.2 / 2014-10-28

• deps: connect@2.27.2
  • Fix handling of URLs containing :// in the path
  • deps: body-parser@~1.9.2
  • deps: qs@2.3.2

3.18.1 / 2014-10-22

• Fix internal utils.merge deprecation warnings
• deps: connect@2.27.1
  • deps: body-parser@~1.9.1
  • deps: express-session@~1.9.1
  • deps: finalhandler@0.3.2
  • deps: morgan@~1.4.1
  • deps: qs@2.3.0
  • deps: serve-static@~1.7.1
• deps: send@0.10.1
  • deps: on-finished@~2.1.1

3.18.0 / 2014-10-17

• Use content-disposition module for res.attachment/res.download
  • Sends standards-compliant Content-Disposition header
  • Full Unicode support
• Use etag module to generate ETag headers
• deps: connect@2.27.0
  • Use http-errors module for creating errors
  • Use utils-merge module for merging objects
  • deps: body-parser@~1.9.0
  • deps: compression@~1.2.0
  • deps: connect-timeout@~1.4.0
  • deps: debug@~2.1.0
  • deps: depd@~1.0.0
  • deps: express-session@~1.9.0
  • deps: finalhandler@0.3.1
  • deps: method-override@~2.3.0
  • deps: morgan@~1.4.0
  • deps: response-time@~2.2.0
  • deps: serve-favicon@~2.1.6
  • deps: serve-index@~1.5.0
  • deps: serve-static@~1.7.0
• deps: debug@~2.1.0
  • Implement DEBUG_FD env variable support
• deps: depd@~1.0.0
• deps: send@0.10.0
  • deps: debug@~2.1.0
  • deps: depd@~1.0.0
  • deps: etag@~1.5.0

3.17.8 / 2014-10-15

• deps: connect@2.26.6
  • deps: compression@~1.1.2
  • deps: csurf@~1.6.2
  • deps: errorhandler@~1.2.2

3.17.7 / 2014-10-08

• deps: connect@2.26.5
  • Fix accepting non-object arguments to logger
  • deps: serve-static@~1.6.4

3.17.6 / 2014-10-02

• deps: connect@2.26.4
  • deps: morgan@~1.3.2
  • deps: type-is@~1.5.2

3.17.5 / 2014-09-24

• deps: connect@2.26.3
  • deps: body-parser@~1.8.4
  • deps: serve-favicon@~2.1.5
  • deps: serve-static@~1.6.3
• deps: proxy-addr@~1.0.3
  • Use forwarded npm module
• deps: send@0.9.3
  • deps: etag@~1.4.0

3.17.4 / 2014-09-19

• deps: connect@2.26.2
  • deps: body-parser@~1.8.3
  • deps: qs@2.2.4

3.17.3 / 2014-09-18

• deps: proxy-addr@~1.0.2
  • Fix a global leak when multiple subnets are trusted
  • deps: ipaddr.js@0.1.3

3.17.2 / 2014-09-15

• Use crc instead of buffer-crc32 for speed
• deps: connect@2.26.1
  • deps: body-parser@~1.8.2
  • deps: depd@0.4.5
  • deps: express-session@~1.8.2
  • deps: morgan@~1.3.1
  • deps: serve-favicon@~2.1.3
  • deps: serve-static@~1.6.2
• deps: depd@0.4.5
• deps: send@0.9.2
  • deps: depd@0.4.5
  • deps: etag@~1.3.1
  • deps: range-parser@~1.0.2

3.17.1 / 2014-09-08

• Fix error in req.subdomains on empty host

3.17.0 / 2014-09-08

• Support X-Forwarded-Host in req.subdomains
• Support IP address host in req.subdomains
• deps: connect@2.26.0
  • deps: body-parser@~1.8.1
  • deps: compression@~1.1.0
  • deps: connect-timeout@~1.3.0
  • deps: cookie-parser@~1.3.3
  • deps: cookie-signature@1.0.5
  • deps: csurf@~1.6.1
  • deps: debug@~2.0.0
  • deps: errorhandler@~1.2.0
  • deps: express-session@~1.8.1
  • deps: finalhandler@0.2.0
  • deps: fresh@0.2.4
  • deps: media-typer@0.3.0
  • deps: method-override@~2.2.0
  • deps: morgan@~1.3.0
  • deps: qs@2.2.3
  • deps: serve-favicon@~2.1.3
  • deps: serve-index@~1.2.1
  • deps: serve-static@~1.6.1
  • deps: type-is@~1.5.1
  • deps: vhost@~3.0.0
• deps: cookie-signature@1.0.5
• deps: debug@~2.0.0
• deps: fresh@0.2.4
• deps: media-typer@0.3.0
  • Throw error when parameter format invalid on parse
• deps: range-parser@~1.0.2
• deps: send@0.9.1
  • Add lastModified option
  • Use etag to generate ETag header
  • deps: debug@~2.0.0
  • deps: fresh@0.2.4
• deps: vary@~1.0.0
  • Accept valid Vary header string as field

3.16.10 / 2014-09-04

• deps: connect@2.25.10
  • deps: serve-static@~1.5.4
• deps: send@0.8.5
  • Fix a path traversal issue when using root
  • Fix malicious path detection for empty string path

3.16.9 / 2014-08-29

• deps: connect@2.25.9
  • deps: body-parser@~1.6.7
  • deps: qs@2.2.2

3.16.8 / 2014-08-27

• deps: connect@2.25.8
  • deps: body-parser@~1.6.6
  • deps: csurf@~1.4.1
  • deps: qs@2.2.0

3.16.7 / 2014-08-18

• deps: connect@2.25.7
  • deps: body-parser@~1.6.5
  • deps: express-session@~1.7.6
  • deps: morgan@~1.2.3
  • deps: serve-static@~1.5.3
• deps: send@0.8.3
  • deps: destroy@1.0.3
  • deps: on-finished@2.1.0

3.16.6 / 2014-08-14

• deps: connect@2.25.6
  • deps: body-parser@~1.6.4
  • deps: qs@1.2.2
  • deps: serve-static@~1.5.2
• deps: send@0.8.2
  • Work around fd leak in Node.js 0.10 for fs.ReadStream

3.16.5 / 2014-08-11

• deps: connect@2.25.5
  • Fix backwards compatibility in logger

3.16.4 / 2014-08-10

• Fix original URL parsing in res.location
• deps: connect@2.25.4
  • Fix query middleware breaking with argument
  • deps: body-parser@~1.6.3
  • deps: compression@~1.0.11
  • deps: connect-timeout@~1.2.2
  • deps: express-session@~1.7.5
  • deps: method-override@~2.1.3
  • deps: on-headers@~1.0.0
  • deps: parseurl@~1.3.0
  • deps: qs@1.2.1
  • deps: response-time@~2.0.1
  • deps: serve-index@~1.1.6
  • deps: serve-static@~1.5.1
• deps: parseurl@~1.3.0

3.16.3 / 2014-08-07

• deps: connect@2.25.3
  • deps: multiparty@3.3.2

3.16.2 / 2014-08-07

• deps: connect@2.25.2
  • deps: body-parser@~1.6.2
  • deps: qs@1.2.0

3.16.1 / 2014-08-06

• deps: connect@2.25.1
  • deps: body-parser@~1.6.1
  • deps: qs@1.1.0

3.16.0 / 2014-08-05

• deps: connect@2.25.0
  • deps: body-parser@~1.6.0
  • deps: compression@~1.0.10
  • deps: csurf@~1.4.0
  • deps: express-session@~1.7.4
  • deps: qs@1.0.2
  • deps: serve-static@~1.5.0
• deps: send@0.8.1
  • Add extensions option

3.15.3 / 2014-08-04

• fix res.sendfile regression for serving directory index files
• deps: connect@2.24.3
  • deps: serve-index@~1.1.5
  • deps: serve-static@~1.4.4
• deps: send@0.7.4
  • Fix incorrect 403 on Windows and Node.js 0.11
  • Fix serving index files without root dir

3.15.2 / 2014-07-27

• deps: connect@2.24.2
  • deps: body-parser@~1.5.2
  • deps: depd@0.4.4
  • deps: express-session@~1.7.2
  • deps: morgan@~1.2.2
  • deps: serve-static@~1.4.2
• deps: depd@0.4.4
  • Work-around v8 generating empty stack traces
• deps: send@0.7.2
  • deps: depd@0.4.4

3.15.1 / 2014-07-26

• deps: connect@2.24.1
  • deps: body-parser@~1.5.1
  • deps: depd@0.4.3
  • deps: express-session@~1.7.1
  • deps: morgan@~1.2.1
  • deps: serve-index@~1.1.4
  • deps: serve-static@~1.4.1
• deps: depd@0.4.3
  • Fix exception when global Error.stackTraceLimit is too low
• deps: send@0.7.1
  • deps: depd@0.4.3

3.15.0 / 2014-07-22

• Fix req.protocol for proxy-direct connections
• Pass options from res.sendfile to send
• deps: connect@2.24.0
  • deps: body-parser@~1.5.0
  • deps: compression@~1.0.9
  • deps: connect-timeout@~1.2.1
  • deps: debug@1.0.4
  • deps: depd@0.4.2
  • deps: express-session@~1.7.0
  • deps: finalhandler@0.1.0
  • deps: method-override@~2.1.2
  • deps: morgan@~1.2.0
  • deps: multiparty@3.3.1
  • deps: parseurl@~1.2.0
  • deps: serve-static@~1.4.0
• deps: debug@1.0.4
• deps: depd@0.4.2
  • Add TRACE_DEPRECATION environment variable
  • Remove non-standard grey color from color output
  • Support --no-deprecation argument
  • Support --trace-deprecation argument
• deps: parseurl@~1.2.0
  • Cache URLs based on original value
  • Remove no-longer-needed URL mis-parse work-around
  • Simplify the "fast-path" RegExp
• deps: send@0.7.0
  • Add dotfiles option
  • Cap maxAge value to 1 year
  • deps: debug@1.0.4
  • deps: depd@0.4.2

3.14.0 / 2014-07-11

• add explicit "Rosetta Flash JSONP abuse" protection
  • previous versions are not vulnerable; this is just explicit protection
• deprecate res.redirect(url, status) -- use res.redirect(status, url) instead
• fix res.send(status, num) to send num as json (not error)
• remove unnecessary escaping when res.jsonp returns JSON response
• deps: basic-auth@1.0.0
  • support empty password
  • support empty username
• deps: connect@2.23.0
  • deps: debug@1.0.3
  • deps: express-session@~1.6.4
  • deps: method-override@~2.1.0
  • deps: parseurl@~1.1.3
  • deps: serve-static@~1.3.1
• deps: debug@1.0.3
  • Add support for multiple wildcards in namespaces
• deps: methods@1.1.0
  • add CONNECT
• deps: parseurl@~1.1.3
  • faster parsing of href-only URLs

3.13.0 / 2014-07-03

• add deprecation message to app.configure
• add deprecation message to req.auth
• use basic-auth to parse Authorization header
• deps: connect@2.22.0
  • deps: csurf@~1.3.0
  • deps: express-session@~1.6.1
  • deps: multiparty@3.3.0
  • deps: serve-static@~1.3.0
• deps: send@0.5.0
  • Accept string for maxage (converted by ms)
  • Include link in default redirect response

3.12.1 / 2014-06-26

• deps: connect@2.21.1
  • deps: cookie-parser@1.3.2
  • deps: cookie-signature@1.0.4
  • deps: express-session@~1.5.2
  • deps: type-is@~1.3.2
• deps: cookie-signature@1.0.4
  • fix for timing attacks

3.12.0 / 2014-06-21

• use media-typer to alter content-type charset
• deps: connect@2.21.0
  • deprecate connect(middleware) -- use app.use(middleware) instead
  • deprecate connect.createServer() -- use connect() instead
  • fix res.setHeader() patch to work with get -> append -> set pattern
  • deps: compression@~1.0.8
  • deps: errorhandler@~1.1.1
  • deps: express-session@~1.5.0
  • deps: serve-index@~1.1.3

3.11.0 / 2014-06-19

• deprecate things with depd module
• deps: buffer-crc32@0.2.3
• deps: connect@2.20.2
  • deprecate verify option to json -- use body-parser npm module instead
  • deprecate verify option to urlencoded -- use body-parser npm module instead
  • deprecate things with depd module
  • use finalhandler for final response handling
  • use media-typer to parse content-type for charset
  • deps: body-parser@1.4.3
  • deps: connect-timeout@1.1.1
  • deps: cookie-parser@1.3.1
  • deps: csurf@1.2.2
  • deps: errorhandler@1.1.0
  • deps: express-session@1.4.0
  • deps: multiparty@3.2.9
  • deps: serve-index@1.1.2
  • deps: type-is@1.3.1
  • deps: vhost@2.0.0

3.10.5 / 2014-06-11

• deps: connect@2.19.6
  • deps: body-parser@1.3.1
  • deps: compression@1.0.7
  • deps: debug@1.0.2
  • deps: serve-index@1.1.1
  • deps: serve-static@1.2.3
• deps: debug@1.0.2
• deps: send@0.4.3
  • Do not throw uncatchable error on file open race condition
  • Use escape-html for HTML escaping
  • deps: debug@1.0.2
  • deps: finished@1.2.2
  • deps: fresh@0.2.2

3.10.4 / 2014-06-09

• deps: connect@2.19.5
  • fix "event emitter leak" warnings
  • deps: csurf@1.2.1
  • deps: debug@1.0.1
  • deps: serve-static@1.2.2
  • deps: type-is@1.2.1
• deps: debug@1.0.1
• deps: send@0.4.2
  • fix "event emitter leak" warnings
  • deps: finished@1.2.1
  • deps: debug@1.0.1

3.10.3 / 2014-06-05

• use vary module for res.vary
• deps: connect@2.19.4
  • deps: errorhandler@1.0.2
  • deps: method-override@2.0.2
  • deps: serve-favicon@2.0.1
• deps: debug@1.0.0

3.10.2 / 2014-06-03

• deps: connect@2.19.3
  • deps: compression@1.0.6

3.10.1 / 2014-06-03

• deps: connect@2.19.2
  • deps: compression@1.0.4
• deps: proxy-addr@1.0.1

3.10.0 / 2014-06-02

• deps: connect@2.19.1
  • deprecate methodOverride() -- use method-override npm module instead
  • deps: body-parser@1.3.0
  • deps: method-override@2.0.1
  • deps: multiparty@3.2.8
  • deps: response-time@2.0.0
  • deps: serve-static@1.2.1
• deps: methods@1.0.1
• deps: send@0.4.1
  • Send max-age in Cache-Control in correct format

3.9.0 / 2014-05-30

• custom etag control with app.set('etag', val)
  • app.set('etag', function(body, encoding){ return '"etag"' }) custom etag generation
  • app.set('etag', 'weak') weak tag
  • app.set('etag', 'strong') strong etag
  • app.set('etag', false) turn off
  • app.set('etag', true) standard etag
• Include ETag in HEAD requests
• mark res.send ETag as weak and reduce collisions
• update connect to 2.18.0
  • deps: compression@1.0.3
  • deps: serve-index@1.1.0
  • deps: serve-static@1.2.0
• update send to 0.4.0
  • Calculate ETag with md5 for reduced collisions
  • Ignore stream errors after request ends
  • deps: debug@0.8.1

3.8.1 / 2014-05-27

• update connect to 2.17.3
  • deps: body-parser@1.2.2
  • deps: express-session@1.2.1
  • deps: method-override@1.0.2

3.8.0 / 2014-05-21

• keep previous Content-Type for res.jsonp
• set proper charset in Content-Type for res.send
• update connect to 2.17.1
  • fix res.charset appending charset when content-type has one
  • deps: express-session@1.2.0
  • deps: morgan@1.1.1
  • deps: serve-index@1.0.3

3.7.0 / 2014-05-18

• proper proxy trust with app.set('trust proxy', trust)
  • app.set('trust proxy', 1) trust first hop
  • app.set('trust proxy', 'loopback') trust loopback addresses
  • app.set('trust proxy', '10.0.0.1') trust single IP
  • app.set('trust proxy', '10.0.0.1/16') trust subnet
  • app.set('trust proxy', '10.0.0.1, 10.0.0.2') trust list
  • app.set('trust proxy', false) turn off
  • app.set('trust proxy', true) trust everything
• update connect to 2.16.2
  • deprecate res.headerSent -- use res.headersSent
  • deprecate res.on("header") -- use on-headers module instead
  • fix edge-case in res.appendHeader that would append in wrong order
  • json: use body-parser
  • urlencoded: use body-parser
  • dep: bytes@1.0.0
  • dep: cookie-parser@1.1.0
  • dep: csurf@1.2.0
  • dep: express-session@1.1.0
  • dep: method-override@1.0.1

3.6.0 / 2014-05-09

• deprecate app.del() -- use app.delete() instead
• deprecate res.json(obj, status) -- use res.json(status, obj) instead
  • the edge-case res.json(status, num) requires res.status(status).json(num)
• deprecate res.jsonp(obj, status) -- use res.jsonp(status, obj) instead
  • the edge-case res.jsonp(status, num) requires res.status(status).jsonp(num)
• support PURGE method
  • add app.purge
  • add router.purge
  • include PURGE in app.all
• update connect to 2.15.0
  • Add res.appendHeader
  • Call error stack even when response has been sent
  • Patch res.headerSent to return Boolean
  • Patch res.headersSent for node.js 0.8
  • Prevent default 404 handler after response sent
  • dep: compression@1.0.2
  • dep: connect-timeout@1.1.0
  • dep: debug@^0.8.0
  • dep: errorhandler@1.0.1
  • dep: express-session@1.0.4
  • dep: morgan@1.0.1
  • dep: serve-favicon@2.0.0
  • dep: serve-index@1.0.2
• update debug to 0.8.0
  • add enable() method
  • change from stderr to stdout
• update methods to 1.0.0
  • add PURGE
• update mkdirp to 0.5.0

3.5.3 / 2014-05-08

• fix req.host for IPv6 literals
• fix res.jsonp error if callback param is object

3.5.2 / 2014-04-24

• update connect to 2.14.5
• update cookie to 0.1.2
• update mkdirp to 0.4.0
• update send to 0.3.0

3.5.1 / 2014-03-25

• pin less-middleware in generated app

3.5.0 / 2014-03-06

• bump deps

3.4.8 / 2014-01-13

• prevent incorrect automatic OPTIONS responses #1868 @dpatti
• update binary and examples for jade 1.0 #1876 @yossi, #1877 @reqshark, #1892 @matheusazzi
• throw 400 in case of malformed paths @rlidwka

3.4.7 / 2013-12-10

• update connect

3.4.6 / 2013-12-01

• update connect (raw-body)

3.4.5 / 2013-11-27

• update connect
• res.location: remove leading ./ #1802 @kapouer
• res.redirect: fix `res.redirect('toString') #1829 @michaelficarra
• res.send: always send ETag when content-length > 0
• router: add Router.all() method

3.4.4 / 2013-10-29

• update connect
• update supertest
• update methods
• express(1): replace bodyParser() with urlencoded() and json() #1795 @chirag04

3.4.3 / 2013-10-23

• update connect

3.4.2 / 2013-10-18

• update connect
• downgrade commander

3.4.1 / 2013-10-15

• update connect
• update commander
• jsonp: check if callback is a function
• router: wrap encodeURIComponent in a try/catch #1735 (@lxe)
• res.format: now includes charset @1747 (@sorribas)
• res.links: allow multiple calls @1746 (@sorribas)

3.4.0 / 2013-09-07

• add res.vary(). Closes #1682
• update connect

3.3.8 / 2013-09-02

• update connect

3.3.7 / 2013-08-28

• update connect

3.3.6 / 2013-08-27

• Revert "remove charset from json responses. Closes #1631" (causes issues in some clients)
• add: req.accepts take an argument list

3.3.4 / 2013-07-08

• update send and connect

3.3.3 / 2013-07-04

• update connect

3.3.2 / 2013-07-03

• update connect
• update send
• remove .version export

3.3.1 / 2013-06-27

• update connect

3.3.0 / 2013-06-26

• update connect
• add support for multiple X-Forwarded-Proto values. Closes #1646
• change: remove charset from json responses. Closes #1631
• change: return actual booleans from req.accept* functions
• fix jsonp callback array throw

3.2.6 / 2013-06-02

• update connect

3.2.5 / 2013-05-21

• update connect
• update node-cookie
• add: throw a meaningful error when there is no default engine
• change generation of ETags with res.send() to GET requests only. Closes #1619

3.2.4 / 2013-05-09

• fix req.subdomains when no Host is present
• fix req.host when no Host is present, return undefined

3.2.3 / 2013-05-07

• update connect / qs

3.2.2 / 2013-05-03

• update qs

3.2.1 / 2013-04-29

• add app.VERB() paths array deprecation warning
• update connect
• update qs and remove all ~ semver crap
• fix: accept number as value of Signed Cookie

3.2.0 / 2013-04-15

• add "view" constructor setting to override view behaviour
• add req.acceptsEncoding(name)
• add req.acceptedEncodings
• revert cookie signature change causing session race conditions
• fix sorting of Accept values of the same quality

3.1.2 / 2013-04-12

• add support for custom Accept parameters
• update cookie-signature

3.1.1 / 2013-04-01

• add X-Forwarded-Host support to req.host
• fix relative redirects
• update mkdirp
• update buffer-crc32
• remove legacy app.configure() method from app template.

3.1.0 / 2013-01-25

• add support for leading "." in "view engine" setting
• add array support to res.set()
• add node 0.8.x to travis.yml
• add "subdomain offset" setting for tweaking req.subdomains
• add res.location(url) implementing res.redirect()-like setting of Location
• use app.get() for x-powered-by setting for inheritance
• fix colons in passwords for req.auth

3.0.6 / 2013-01-04

• add http verb methods to Router
• update connect
• fix mangling of the res.cookie() options object
• fix jsonp whitespace escape. Closes #1132

3.0.5 / 2012-12-19

• add throwing when a non-function is passed to a route
• fix: explicitly remove Transfer-Encoding header from 204 and 304 responses
• revert "add 'etag' option"

3.0.4 / 2012-12-05

• add 'etag' option to disable res.send() Etags
• add escaping of urls in text/plain in res.redirect() for old browsers interpreting as html
• change crc32 module for a more liberal license
• update connect

3.0.3 / 2012-11-13

• update connect
• update cookie module
• fix cookie max-age

3.0.2 / 2012-11-08

• add OPTIONS to cors example. Closes #1398
• fix route chaining regression. Closes #1397

3.0.1 / 2012-11-01

• update connect

3.0.0 / 2012-10-23

• add make clean
• add "Basic" check to req.auth
• add req.auth test coverage
• add cb && cb(payload) to res.jsonp(). Closes #1374
• add backwards compat for res.redirect() status. Closes #1336
• add support for res.json() to retain previously defined Content-Types. Closes #1349
• update connect
• change res.redirect() to utilize a pathname-relative Location again. Closes #1382
• remove non-primitive string support for res.send()
• fix view-locals example. Closes #1370
• fix route-separation example

3.0.0rc5 / 2012-09-18

• update connect
• add redis search example
• add static-files example
• add "x-powered-by" setting (app.disable('x-powered-by'))
• add "application/octet-stream" redirect Accept test case. Closes #1317

3.0.0rc4 / 2012-08-30

• add res.jsonp(). Closes #1307
• add "verbose errors" option to error-pages example
• add another route example to express(1) so people are not so confused
• add redis online user activity tracking example
• update connect dep
• fix etag quoting. Closes #1310
• fix error-pages 404 status
• fix jsonp callback char restrictions
• remove old OPTIONS default response

3.0.0rc3 / 2012-08-13

• update connect dep
• fix signed cookies to work with connect.cookieParser() ("s:" prefix was missing) [tnydwrds]
• fix res.render() clobbering of "locals"

3.0.0rc2 / 2012-08-03

• add CORS example
• update connect dep
• deprecate .createServer() & remove old stale examples
• fix: escape res.redirect() link
• fix vhost example

3.0.0rc1 / 2012-07-24

• add more examples to view-locals
• add scheme-relative redirects (res.redirect("//foo.com")) support
• update cookie dep
• update connect dep
• update send dep
• fix express(1) -h flag, use -H for hogan. Closes #1245
• fix res.sendfile() socket error handling regression

3.0.0beta7 / 2012-07-16

• update connect dep for send() root normalization regression

3.0.0beta6 / 2012-07-13

• add err.view property for view errors. Closes #1226
• add "jsonp callback name" setting
• add support for "/foo/:bar*" non-greedy matches
• change res.sendfile() to use send() module
• change res.send to use "response-send" module
• remove app.locals.use and res.locals.use, use regular middleware

3.0.0beta5 / 2012-07-03

• add "make check" support
• add route-map example
• add res.json(obj, status) support back for BC
• add "methods" dep, remove internal methods module
• update connect dep
• update auth example to utilize cores pbkdf2
• updated tests to use "supertest"

3.0.0beta4 / 2012-06-25

• Added req.auth
• Added req.range(size)
• Added res.links(obj)
• Added res.send(body, status) support back for backwards compat
• Added .default() support to res.format()
• Added 2xx / 304 check to req.fresh
• Revert "Added + support to the router"
• Fixed res.send() freshness check, respect res.statusCode

3.0.0beta3 / 2012-06-15

• Added hogan --hjs to express(1) [nullfirm]
• Added another example to content-negotiation
• Added fresh dep
• Changed: res.send() always checks freshness
• Fixed: expose connects mime module. Closes #1165

3.0.0beta2 / 2012-06-06

• Added + support to the router
• Added req.host
• Changed req.param() to check route first
• Update connect dep

3.0.0beta1 / 2012-06-01

• Added res.format() callback to override default 406 behaviour
• Fixed res.redirect() 406. Closes #1154

3.0.0alpha5 / 2012-05-30

• Added req.ip
• Added { signed: true } option to res.cookie()
• Removed res.signedCookie()
• Changed: dont reverse req.ips
• Fixed "trust proxy" setting check for req.ips

3.0.0alpha4 / 2012-05-09

• Added: allow [] in jsonp callback. Closes #1128
• Added PORT env var support in generated template. Closes #1118 [benatkin]
• Updated: connect 2.2.2

3.0.0alpha3 / 2012-05-04

• Added public app.routes. Closes #887
• Added view-locals example
• Added mvc example
• Added res.locals.use(). Closes #1120
• Added conditional-GET support to res.send()
• Added: coerce res.set() values to strings
• Changed: moved static() in generated apps below router
• Changed: res.send() only set ETag when not previously set
• Changed connect 2.2.1 dep
• Changed: make test now runs unit / acceptance tests
• Fixed req/res proto inheritance

3.0.0alpha2 / 2012-04-26

• Added make benchmark back
• Added res.send() support for String objects
• Added client-side data exposing example
• Added res.header() and req.header() aliases for BC
• Added express.createServer() for BC
• Perf: memoize parsed urls
• Perf: connect 2.2.0 dep
• Changed: make expressInit() middleware self-aware
• Fixed: use app.get() for all core settings
• Fixed redis session example
• Fixed session example. Closes #1105
• Fixed generated express dep. Closes #1078

3.0.0alpha1 / 2012-04-15

• Added app.locals.use(callback)
• Added app.locals object
• Added app.locals(obj)
• Added res.locals object
• Added res.locals(obj)
• Added res.format() for content-negotiation
• Added app.engine()
• Added res.cookie() JSON cookie support
• Added "trust proxy" setting
• Added req.subdomains
• Added req.protocol
• Added req.secure
• Added req.path
• Added req.ips
• Added req.fresh
• Added req.stale
• Added comma-delimited / array support for req.accepts()
• Added debug instrumentation
• Added res.set(obj)
• Added res.set(field, value)
• Added res.get(field)
• Added app.get(setting). Closes #842
• Added req.acceptsLanguage()
• Added req.acceptsCharset()
• Added req.accepted
• Added req.acceptedLanguages
• Added req.acceptedCharsets
• Added "json replacer" setting
• Added "json spaces" setting
• Added X-Forwarded-Proto support to res.redirect(). Closes #92
• Added --less support to express(1)
• Added express.response prototype
• Added express.request prototype
• Added express.application prototype
• Added app.path()
• Added app.render()
• Added res.type() to replace res.contentType()
• Changed: res.redirect() to add relative support
• Changed: enable "jsonp callback" by default
• Changed: renamed "case sensitive routes" to "case sensitive routing"
• Rewrite of all tests with mocha
• Removed "root" setting
• Removed res.redirect('home') support
• Removed req.notify()
• Removed app.register()
• Removed app.redirect()
• Removed app.is()
• Removed app.helpers()
• Removed app.dynamicHelpers()
• Fixed res.sendfile() with non-GET. Closes #723
• Fixed express(1) public dir for windows. Closes #866

2.5.9/ 2012-04-02

• Added support for PURGE request method [pbuyle]
• Fixed express(1) generated app app.address() before listening [mmalecki]

2.5.8 / 2012-02-08

• Update mkdirp dep. Closes #991

2.5.7 / 2012-02-06

• Fixed app.all duplicate DELETE requests [mscdex]

2.5.6 / 2012-01-13

• Updated hamljs dev dep. Closes #953

2.5.5 / 2012-01-08

• Fixed: set filename on cached templates [matthewleon]

2.5.4 / 2012-01-02

• Fixed express(1) eol on 0.4.x. Closes #947

2.5.3 / 2011-12-30

• Fixed req.is() when a charset is present

2.5.2 / 2011-12-10

• Fixed: express(1) LF -> CRLF for windows

2.5.1 / 2011-11-17

• Changed: updated connect to 1.8.x
• Removed sass.js support from express(1)

2.5.0 / 2011-10-24

• Added ./routes dir for generated app by default
• Added npm install reminder to express(1) app gen
• Added 0.5.x support
• Removed make test-cov since it wont work with node 0.5.x
• Fixed express(1) public dir for windows. Closes #866

2.4.7 / 2011-10-05

• Added mkdirp to express(1). Closes #795
• Added simple json-config example
• Added shorthand for the parsed request's pathname via req.path
• Changed connect dep to 1.7.x to fix npm issue...
• Fixed res.redirect() HEAD support. [reported by xerox]
• Fixed req.flash(), only escape args
• Fixed absolute path checking on windows. Closes #829 [reported by andrewpmckenzie]

2.4.6 / 2011-08-22

• Fixed multiple param callback regression. Closes #824 [reported by TroyGoode]

2.4.5 / 2011-08-19

• Added support for routes to handle errors. Closes #809
• Added app.routes.all(). Closes #803
• Added "basepath" setting to work in conjunction with reverse proxies etc.
• Refactored Route to use a single array of callbacks
• Added support for multiple callbacks for app.param(). Closes #801 Closes #805
• Changed: removed .call(self) for route callbacks
• Dependency: qs >= 0.3.1
• Fixed res.redirect() on windows due to join() usage. Closes #808

2.4.4 / 2011-08-05

• Fixed res.header() intention of a set, even when undefined
• Fixed *, value no longer required
• Fixed res.send(204) support. Closes #771

2.4.3 / 2011-07-14

• Added docs for status option special-case. Closes #739
• Fixed options.filename, exposing the view path to template engines

2.4.2. / 2011-07-06

• Revert "removed jsonp stripping" for XSS

2.4.1 / 2011-07-06

• Added res.json() JSONP support. Closes #737
• Added extending-templates example. Closes #730
• Added "strict routing" setting for trailing slashes
• Added support for multiple envs in app.configure() calls. Closes #735
• Changed: res.send() using res.json()
• Changed: when cookie path === null don't default it
• Changed; default cookie path to "home" setting. Closes #731
• Removed pids/logs creation from express(1)

2.4.0 / 2011-06-28

• Added chainable res.status(code)
• Added res.json(), an explicit version of res.send(obj)
• Added simple web-service example

2.3.12 / 2011-06-22

• #express is now on freenode! come join!
• Added req.get(field, param)
• Added links to Japanese documentation, thanks @hideyukisaito!
• Added; the express(1) generated app outputs the env
• Added content-negotiation example
• Dependency: connect >= 1.5.1 < 2.0.0
• Fixed view layout bug. Closes #720
• Fixed; ignore body on 304. Closes #701

2.3.11 / 2011-06-04

• Added npm test
• Removed generation of dummy test file from express(1)
• Fixed; express(1) adds express as a dep
• Fixed; prune on prepublish

2.3.10 / 2011-05-27

• Added req.route, exposing the current route
• Added package.json generation support to express(1)
• Fixed call to app.param() function for optional params. Closes #682

2.3.9 / 2011-05-25

• Fixed bug-ish with ../' in res.partial()` calls

2.3.8 / 2011-05-24

• Fixed app.options()

2.3.7 / 2011-05-23

• Added route Collection, ex: app.get('/user/:id').remove();
• Added support for app.param(fn) to define param logic
• Removed app.param() support for callback with return value
• Removed module.parent check from express(1) generated app. Closes #670
• Refactored router. Closes #639

2.3.6 / 2011-05-20

• Changed; using devDependencies instead of git submodules
• Fixed redis session example
• Fixed markdown example
• Fixed view caching, should not be enabled in development

2.3.5 / 2011-05-20

• Added export .view as alias for .View

2.3.4 / 2011-05-08

• Added ./examples/say
• Fixed res.sendfile() bug preventing the transfer of files with spaces

2.3.3 / 2011-05-03

• Added "case sensitive routes" option.
• Changed; split methods supported per rfc [slaskis]
• Fixed route-specific middleware when using the same callback function several times

2.3.2 / 2011-04-27

• Fixed view hints

2.3.1 / 2011-04-26

• Added app.match() as app.match.all()
• Added app.lookup() as app.lookup.all()
• Added app.remove() for app.remove.all()
• Added app.remove.VERB()
• Fixed template caching collision issue. Closes #644
• Moved router over from connect and started refactor

2.3.0 / 2011-04-25

• Added options support to res.clearCookie()
• Added res.helpers() as alias of res.locals()
• Added; json defaults to UTF-8 with res.send(). Closes #632. [Daniel * Dependency connect >= 1.4.0
• Changed; auto set Content-Type in res.attachement [Aaron Heckmann]
• Renamed "cache views" to "view cache". Closes #628
• Fixed caching of views when using several apps. Closes #637
• Fixed gotcha invoking app.param() callbacks once per route middleware. Closes #638
• Fixed partial lookup precedence. Closes #631 Shaw]

2.2.2 / 2011-04-12

• Added second callback support for res.download() connection errors
• Fixed filename option passing to template engine

2.2.1 / 2011-04-04

• Added layout(path) helper to change the layout within a view. Closes #610

• Fixed partial() collection object support. Previously only anything with .length would work. When .length is present one must still be aware of holes, however now { collection: {foo: 'bar'}} is valid, exposes keyInCollection and keysInCollection.

• Performance improved with better view caching

• Removed request and response locals

• Changed; errorHandler page title is now Express instead of Connect

2.2.0 / 2011-03-30

• Added app.lookup.VERB(), ex app.lookup.put('/user/:id'). Closes #606
• Added app.match.VERB(), ex app.match.put('/user/12'). Closes #606
• Added app.VERB(path) as alias of app.lookup.VERB().
• Dependency connect >= 1.2.0

2.1.1 / 2011-03-29

• Added; expose err.view object when failing to locate a view
• Fixed res.partial() call next(err) when no callback is given [reported by aheckmann]
• Fixed; res.send(undefined) responds with 204 [aheckmann]

2.1.0 / 2011-03-24

• Added <root>/_?<name> partial lookup support. Closes #447
• Added request, response, and app local variables
• Added settings local variable, containing the app's settings
• Added req.flash() exception if req.session is not available
• Added res.send(bool) support (json response)
• Fixed stylus example for latest version
• Fixed; wrap try/catch around res.render()

2.0.0 / 2011-03-17

• Fixed up index view path alternative.
• Changed; res.locals() without object returns the locals

2.0.0rc3 / 2011-03-17

• Added res.locals(obj) to compliment res.local(key, val)
• Added res.partial() callback support
• Fixed recursive error reporting issue in res.render()

2.0.0rc2 / 2011-03-17

• Changed; partial() "locals" are now optional
• Fixed SlowBuffer support. Closes #584 [reported by tyrda01]
• Fixed .filename view engine option [reported by drudge]
• Fixed blog example
• Fixed {req,res}.app reference when mounting [Ben Weaver]

2.0.0rc / 2011-03-14

• Fixed; expose HTTPSServer constructor
• Fixed express(1) default test charset. Closes #579 [reported by secoif]
• Fixed; default charset to utf-8 instead of utf8 for lame IE [reported by NickP]

2.0.0beta3 / 2011-03-09

• Added support for res.contentType() literal The original res.contentType('.json'), res.contentType('application/json'), and res.contentType('json') will work now.
• Added res.render() status option support back
• Added charset option for res.render()
• Added .charset support (via connect 1.0.4)
• Added view resolution hints when in development and a lookup fails
• Added layout lookup support relative to the page view. For example while rendering ./views/user/index.jade if you create ./views/user/layout.jade it will be used in favour of the root layout.
• Fixed res.redirect(). RFC states absolute url [reported by unlink]
• Fixed; default res.send() string charset to utf8
• Removed Partial constructor (not currently used)

2.0.0beta2 / 2011-03-07

• Added res.render() .locals support back to aid in migration process
• Fixed flash example

2.0.0beta / 2011-03-03

• Added HTTPS support
• Added res.cookie() maxAge support
• Added req.header() Referrer / Referer special-case, either works
• Added mount support for res.redirect(), now respects the mount-point
• Added union() util, taking place of merge(clone()) combo
• Added stylus support to express(1) generated app
• Added secret to session middleware used in examples and generated app
• Added res.local(name, val) for progressive view locals
• Added default param support to req.param(name, default)
• Added app.disabled() and app.enabled()
• Added app.register() support for omitting leading ".", either works
• Added res.partial(), using the same interface as partial() within a view. Closes #539
• Added app.param() to map route params to async/sync logic
• Added; aliased app.helpers() as app.locals(). Closes #481
• Added extname with no leading "." support to res.contentType()
• Added cache views setting, defaulting to enabled in "production" env
• Added index file partial resolution, eg: partial('user') may try views/user/index.jade.
• Added req.accepts() support for extensions
• Changed; res.download() and res.sendfile() now utilize Connect's static file server connect.static.send().
• Changed; replaced connect.utils.mime() with npm mime module
• Changed; allow req.query to be pre-defined (via middleware or other parent
• Changed view partial resolution, now relative to parent view
• Changed view engine signature. no longer engine.render(str, options, callback), now engine.compile(str, options) -> Function, the returned function accepts fn(locals).
• Fixed req.param() bug returning Array.prototype methods. Closes #552
• Fixed; using Stream#pipe() instead of sys.pump() in res.sendfile()
• Fixed; using qs module instead of querystring
• Fixed; strip unsafe chars from jsonp callbacks
• Removed "stream threshold" setting

1.0.8 / 2011-03-01

• Allow req.query to be pre-defined (via middleware or other parent app)
• "connect": ">= 0.5.0 < 1.0.0". Closes #547
• Removed the long deprecated EXPRESS_ENV support

1.0.7 / 2011-02-07

• Fixed render() setting inheritance. Mounted apps would not inherit "view engine"

1.0.6 / 2011-02-07

• Fixed view engine setting bug when period is in dirname

1.0.5 / 2011-02-05

• Added secret to generated app session() call

1.0.4 / 2011-02-05

• Added qs dependency to package.json
• Fixed namespaced require()s for latest connect support

1.0.3 / 2011-01-13

• Remove unsafe characters from JSONP callback names [Ryan Grove]

1.0.2 / 2011-01-10

• Removed nested require, using connect.router

1.0.1 / 2010-12-29

• Fixed for middleware stacked via createServer() previously the foo middleware passed to createServer(foo) would not have access to Express methods such as res.send() or props like req.query etc.

1.0.0 / 2010-11-16

• Added; deduce partial object names from the last segment. For example by default partial('forum/post', postObject) will give you the post object, providing a meaningful default.
• Added http status code string representation to res.redirect() body
• Added; res.redirect() supporting text/plain and text/html via Accept.
• Added req.is() to aid in content negotiation
• Added partial local inheritance [suggested by masylum]. Closes #102 providing access to parent template locals.
• Added -s, --session[s] flag to express(1) to add session related middleware
• Added --template flag to express(1) to specify the template engine to use.
• Added --css flag to express(1) to specify the stylesheet engine to use (or just plain css by default).
• Added app.all() support [thanks aheckmann]
• Added partial direct object support. You may now partial('user', user) providing the "user" local, vs previously partial('user', { object: user }).
• Added route-separation example since many people question ways to do this with CommonJS modules. Also view the blog example for an alternative.
• Performance; caching view path derived partial object names
• Fixed partial local inheritance precedence. [reported by Nick Poulden] Closes #454
• Fixed jsonp support; text/javascript as per mailinglist discussion

1.0.0rc4 / 2010-10-14

• Added NODE_ENV support, EXPRESS_ENV is deprecated and will be removed in 1.0.0
• Added route-middleware support (very helpful, see the docs)
• Added jsonp callback setting to enable/disable jsonp autowrapping [Dav Glass]
• Added callback query check on response.send to autowrap JSON objects for simple webservice implementations [Dav Glass]
• Added partial() support for array-like collections. Closes #434
• Added support for swappable querystring parsers
• Added session usage docs. Closes #443
• Added dynamic helper caching. Closes #439 [suggested by maritz]
• Added authentication example
• Added basic Range support to res.sendfile() (and res.download() etc)
• Changed; express(1) generated app using 2 spaces instead of 4
• Default env to "development" again [aheckmann]
• Removed context option is no more, use "scope"
• Fixed; exposing ./support libs to examples so they can run without installs
• Fixed mvc example

1.0.0rc3 / 2010-09-20

• Added confirmation for express(1) app generation. Closes #391
• Added extending of flash formatters via app.flashFormatters
• Added flash formatter support. Closes #411
• Added streaming support to res.sendfile() using sys.pump() when >= "stream threshold"
• Added stream threshold setting for res.sendfile()
• Added res.send() HEAD support
• Added res.clearCookie()
• Added res.cookie()
• Added res.render() headers option
• Added res.redirect() response bodies
• Added res.render() status option support. Closes #425 [thanks aheckmann]
• Fixed res.sendfile() responding with 403 on malicious path
• Fixed res.download() bug; when an error occurs remove Content-Disposition
• Fixed; mounted apps settings now inherit from parent app [aheckmann]
• Fixed; stripping Content-Length / Content-Type when 204
• Fixed res.send() 204. Closes #419
• Fixed multiple Set-Cookie headers via res.header(). Closes #402
• Fixed bug messing with error handlers when listenFD() is called instead of listen(). [thanks guillermo]

1.0.0rc2 / 2010-08-17

• Added app.register() for template engine mapping. Closes #390
• Added res.render() callback support as second argument (no options)
• Added callback support to res.download()
• Added callback support for res.sendfile()
• Added support for middleware access via express.middlewareName() vs connect.middlewareName()
• Added "partials" setting to docs
• Added default expresso tests to express(1) generated app. Closes #384
• Fixed res.sendfile() error handling, defer via next()
• Fixed res.render() callback when a layout is used [thanks guillermo]
• Fixed; make install creating ~/.node_libraries when not present
• Fixed issue preventing error handlers from being defined anywhere. Closes #387

1.0.0rc / 2010-07-28

• Added mounted hook. Closes #369

• Added connect dependency to package.json

• Removed "reload views" setting and support code development env never caches, production always caches.

• Removed param in route callbacks, signature is now simply (req, res, next), previously (req, res, params, next). Use req.params for path captures, req.query for GET params.

• Fixed "home" setting

• Fixed middleware/router precedence issue. Closes #366

• Fixed; configure() callbacks called immediately. Closes #368

1.0.0beta2 / 2010-07-23

• Added more examples
• Added; exporting Server constructor
• Added Server#helpers() for view locals
• Added Server#dynamicHelpers() for dynamic view locals. Closes #349
• Added support for absolute view paths
• Added; home setting defaults to Server#route for mounted apps. Closes #363
• Added Guillermo Rauch to the contributor list
• Added support for "as" for non-collection partials. Closes #341
• Fixed install.sh, ensuring ~/.node_libraries exists. Closes #362 [thanks jf]
• Fixed res.render() exceptions, now passed to next() when no callback is given [thanks guillermo]
• Fixed instanceof Array checks, now Array.isArray()
• Fixed express(1) expansion of public dirs. Closes #348
• Fixed middleware precedence. Closes #345
• Fixed view watcher, now async [thanks aheckmann]

1.0.0beta / 2010-07-15

• Re-write
  • much faster
  • much lighter
  • Check ExpressJS.com for migration guide and updated docs

0.14.0 / 2010-06-15

• Utilize relative requires
• Added Static bufferSize option [aheckmann]
• Fixed caching of view and partial subdirectories [aheckmann]
• Fixed mime.type() comments now that ".ext" is not supported
• Updated haml submodule
• Updated class submodule
• Removed bin/express

0.13.0 / 2010-06-01

• Added node v0.1.97 compatibility
• Added support for deleting cookies via Request#cookie('key', null)
• Updated haml submodule
• Fixed not-found page, now using charset utf-8
• Fixed show-exceptions page, now using charset utf-8
• Fixed view support due to fs.readFile Buffers
• Changed; mime.type() no longer accepts ".type" due to node extname() changes

0.12.0 / 2010-05-22

• Added node v0.1.96 compatibility
• Added view helpers export which act as additional local variables
• Updated haml submodule
• Changed ETag; removed inode, modified time only
• Fixed LF to CRLF for setting multiple cookies
• Fixed cookie compilation; values are now urlencoded
• Fixed cookies parsing; accepts quoted values and url escaped cookies

0.11.0 / 2010-05-06

• Added support for layouts using different engines
  • this.render('page.html.haml', { layout: 'super-cool-layout.html.ejs' })
  • this.render('page.html.haml', { layout: 'foo' }) // assumes 'foo.html.haml'
  • this.render('page.html.haml', { layout: false }) // no layout
• Updated ext submodule
• Updated haml submodule
• Fixed EJS partial support by passing along the context. Issue #307

0.10.1 / 2010-05-03

• Fixed binary uploads.

0.10.0 / 2010-04-30

• Added charset support via Request#charset (automatically assigned to 'UTF-8' when respond()'s encoding is set to 'utf8' or 'utf-8').
• Added "encoding" option to Request#render(). Closes #299
• Added "dump exceptions" setting, which is enabled by default.
• Added simple ejs template engine support
• Added error response support for text/plain, application/json. Closes #297
• Added callback function param to Request#error()
• Added Request#sendHead()
• Added Request#stream()
• Added support for Request#respond(304, null) for empty response bodies
• Added ETag support to Request#sendfile()
• Added options to Request#sendfile(), passed to fs.createReadStream()
• Added filename arg to Request#download()
• Performance enhanced due to pre-reversing plugins so that plugins.reverse() is not called on each request
• Performance enhanced by preventing several calls to toLowerCase() in Router#match()
• Changed; Request#sendfile() now streams
• Changed; Renamed Request#halt() to Request#respond(). Closes #289
• Changed; Using sys.inspect() instead of JSON.encode() for error output
• Changed; run() returns the http.Server instance. Closes #298
• Changed; Defaulting Server#host to null (INADDR_ANY)
• Changed; Logger "common" format scale of 0.4f
• Removed Logger "request" format
• Fixed; Catching ENOENT in view caching, preventing error when "views/partials" is not found
• Fixed several issues with http client
• Fixed Logger Content-Length output
• Fixed bug preventing Opera from retaining the generated session id. Closes #292

0.9.0 / 2010-04-14

• Added DSL level error() route support
• Added DSL level notFound() route support
• Added Request#error()
• Added Request#notFound()
• Added Request#render() callback function. Closes #258
• Added "max upload size" setting
• Added "magic" variables to collection partials (__index__, __length__, __isFirst__, __isLast__). Closes #254
• Added haml.js submodule; removed haml-js
• Added callback function support to Request#halt() as 3rd/4th arg
• Added preprocessing of route param wildcards using param(). Closes #251
• Added view partial support (with collections etc.)
• Fixed bug preventing falsey params (such as ?page=0). Closes #286
• Fixed setting of multiple cookies. Closes #199
• Changed; view naming convention is now NAME.TYPE.ENGINE (for example page.html.haml)
• Changed; session cookie is now httpOnly
• Changed; Request is no longer global
• Changed; Event is no longer global
• Changed; "sys" module is no longer global
• Changed; moved Request#download to Static plugin where it belongs
• Changed; Request instance created before body parsing. Closes #262
• Changed; Pre-caching views in memory when "cache view contents" is enabled. Closes #253
• Changed; Pre-caching view partials in memory when "cache view partials" is enabled
• Updated support to node --version 0.1.90
• Updated dependencies
• Removed set("session cookie") in favour of use(Session, { cookie: { ... }})
• Removed utils.mixin(); use Object#mergeDeep()

0.8.0 / 2010-03-19

• Added coffeescript example app. Closes #242
• Changed; cache api now async friendly. Closes #240
• Removed deprecated 'express/static' support. Use 'express/plugins/static'

0.7.6 / 2010-03-19

• Added Request#isXHR. Closes #229
• Added make install (for the executable)
• Added express executable for setting up simple app templates
• Added "GET /public/*" to Static plugin, defaulting to /public
• Added Static plugin
• Fixed; Request#render() only calls cache.get() once
• Fixed; Namespacing View caches with "view:"
• Fixed; Namespacing Static caches with "static:"
• Fixed; Both example apps now use the Static plugin
• Fixed set("views"). Closes #239
• Fixed missing space for combined log format
• Deprecated Request#sendfile() and 'express/static'
• Removed Server#running

0.7.5 / 2010-03-16

• Added Request#flash() support without args, now returns all flashes
• Updated ext submodule

0.7.4 / 2010-03-16

• Fixed session reaper
• Changed; class.js replacing js-oo Class implementation (quite a bit faster, no browser cruft)

0.7.3 / 2010-03-16

• Added package.json
• Fixed requiring of haml / sass due to kiwi removal

0.7.2 / 2010-03-16

• Fixed GIT submodules (HAH!)

0.7.1 / 2010-03-16

• Changed; Express now using submodules again until a PM is adopted
• Changed; chat example using millisecond conversions from ext

0.7.0 / 2010-03-15

• Added Request#pass() support (finds the next matching route, or the given path)
• Added Logger plugin (default "common" format replaces CommonLogger)
• Removed Profiler plugin
• Removed CommonLogger plugin

0.6.0 / 2010-03-11

• Added seed.yml for kiwi package management support

• Added HTTP client query string support when method is GET. Closes #205

• Added support for arbitrary view engines. For example "foo.engine.html" will now require('engine'), the exports from this module are cached after the first require().

• Added async plugin support

• Removed usage of RESTful route funcs as http client get() etc, use http.get() and friends

• Removed custom exceptions

0.5.0 / 2010-03-10

• Added ext dependency (library of js extensions)
• Removed extname() / basename() utils. Use path module
• Removed toArray() util. Use arguments.values
• Removed escapeRegexp() util. Use RegExp.escape()
• Removed process.mixin() dependency. Use utils.mixin()
• Removed Collection
• Removed ElementCollection
• Shameless self promotion of ebook "Advanced JavaScript" (http://dev-mag.com) ;)

0.4.0 / 2010-02-11

• Added flash() example to sample upload app
• Added high level restful http client module (express/http)
• Changed; RESTful route functions double as HTTP clients. Closes #69
• Changed; throwing error when routes are added at runtime
• Changed; defaulting render() context to the current Request. Closes #197
• Updated haml submodule

0.3.0 / 2010-02-11

• Updated haml / sass submodules. Closes #200
• Added flash message support. Closes #64
• Added accepts() now allows multiple args. fixes #117
• Added support for plugins to halt. Closes #189
• Added alternate layout support. Closes #119
• Removed Route#run(). Closes #188
• Fixed broken specs due to use(Cookie) missing

0.2.1 / 2010-02-05

• Added "plot" format option for Profiler (for gnuplot processing)
• Added request number to Profiler plugin
• Fixed binary encoding for multipart file uploads, was previously defaulting to UTF8
• Fixed issue with routes not firing when not files are present. Closes #184
• Fixed process.Promise -> events.Promise

0.2.0 / 2010-02-03

• Added parseParam() support for name[] etc. (allows for file inputs with "multiple" attr) Closes #180
• Added Both Cache and Session option "reapInterval" may be "reapEvery". Closes #174
• Added expiration support to cache api with reaper. Closes #133
• Added cache Store.Memory#reap()
• Added Cache; cache api now uses first class Cache instances
• Added abstract session Store. Closes #172
• Changed; cache Memory.Store#get() utilizing Collection
• Renamed MemoryStore -> Store.Memory
• Fixed use() of the same plugin several time will always use latest options. Closes #176

0.1.0 / 2010-02-03

• Changed; Hooks (before / after) pass request as arg as well as evaluated in their context
• Updated node support to 0.1.27 Closes #169
• Updated dirname(__filename) -> __dirname
• Updated libxmljs support to v0.2.0
• Added session support with memory store / reaping
• Added quick uid() helper
• Added multi-part upload support
• Added Sass.js support / submodule
• Added production env caching view contents and static files
• Added static file caching. Closes #136
• Added cache plugin with memory stores
• Added support to StaticFile so that it works with non-textual files.
• Removed dirname() helper
• Removed several globals (now their modules must be required)

0.0.2 / 2010-01-10

• Added view benchmarks; currently haml vs ejs
• Added Request#attachment() specs. Closes #116
• Added use of node's parseQuery() util. Closes #123
• Added make init for submodules
• Updated Haml
• Updated sample chat app to show messages on load
• Updated libxmljs parseString -> parseHtmlString
• Fixed make init to work with older versions of git
• Fixed specs can now run independent specs for those who can't build deps. Closes #127
• Fixed issues introduced by the node url module changes. Closes 126.
• Fixed two assertions failing due to Collection#keys() returning strings
• Fixed faulty Collection#toArray() spec due to keys() returning strings
• Fixed make test now builds libxmljs.node before testing

0.0.1 / 2010-01-03

• Initial release