Skip to content

[Snyk] Upgrade express from 4.19.2 to 5.2.1#94

Open
mhill-os wants to merge 2 commits into
masterfrom
snyk-upgrade-c6d26e10170cccc44b9916bb19760200
Open

[Snyk] Upgrade express from 4.19.2 to 5.2.1#94
mhill-os wants to merge 2 commits into
masterfrom
snyk-upgrade-c6d26e10170cccc44b9916bb19760200

Conversation

@mhill-os

@mhill-os mhill-os commented Jul 1, 2026

Copy link
Copy Markdown

snyk-top-banner

Snyk has created this PR to upgrade express from 4.19.2 to 5.2.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 23 versions ahead of your current version.

  • The recommended version was released 7 months ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860		 40 No Known Exploit
high severity Allocation of Resources Without Limits or Throttling
SNYK-JS-QS-14724253		 40 Proof of Concept
high severity Allocation of Resources Without Limits or Throttling
SNYK-JS-QS-15268416		 40 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-COOKIE-8163060		 40 No Known Exploit
medium severity Cross-site Scripting
SNYK-JS-EXPRESS-7926867		 40 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-15789761		 40 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106		 40 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-8482416		 40 Proof of Concept
low severity Cross-site Scripting
SNYK-JS-SEND-7926862		 40 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865		 40 No Known Exploit

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.

Release notes
Package name: express

@mhill-os

mhill-os commented Jul 1, 2026

Copy link
Copy Markdown
Author

Merge Risk: High

This is a major version upgrade from Express 4 to 5, which introduces significant breaking changes after a long development period. A careful migration is required.

Key Breaking Changes:

  • Node.js Version: Express 5 requires Node.js version 18 or higher. [4, 7, 11]
  • Removed & Renamed Methods: Several deprecated methods and signatures from v4 have been removed. Code using them will break and must be refactored. [10]
    • app.del() is replaced by app.delete(). [1, 10]
    • req.param(name) is removed. You must now explicitly use req.params, req.body, or req.query. [6, 8]
    • res.send(status, body) is removed. Use the chained res.status(status).send(body) method instead. [9, 10]
    • The 'back' value in res.redirect() is no longer supported. [10, 11]
  • Routing & Path Matching: The path matching engine was updated. Inline regular expressions in route paths are no longer supported, and wildcards must be named (e.g., '/foo/*' becomes '/foo/:splat'). [1, 2, 4]
  • Async Error Handling: Promise rejections in async route handlers are now automatically caught and passed to your error handling middleware, which may change application behavior and removes the need for try/catch blocks or third-party packages for this purpose. [2, 7, 11]
  • Body Parsing: The built-in bodyParser middleware has been updated. req.body is no longer initialized to an empty object if no body is present; it will be undefined. [2, 8]

Recommendation:
This upgrade requires significant code modifications. Use the official codemods provided by the Express team to automate parts of the migration process. [3, 10] Review the full migration guide and test your application thoroughly before deploying.

Source: Official Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@mhill-os

mhill-os commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mhill-os @snyk-bot