voyagi/bumpwarden-demo-app / express

express 4.17.1 to 5.3.0

Scored 74 of 100, which is held. Every factor below is computed from a source you can open, and the sum decides the band. Nothing here is a judgement call.

Where this sits

The same axis as the queue, so this bump's place in the run is legible.

express 62

chalk 71

express 74

glob 87

Machine explanation, not verdict

Upgrade Express to v5.3.0 (Major Version Update)

Express has been upgraded from v4.17.1 to v5.3.0. This major release introduces several breaking changes, performance improvements, and security fixes. Key changes include: Node.js 18 is now the minimum supported version; res.clearCookie() now ignores expires and maxAge options; res.send(status) and res.send(status, body) are removed (use res.sendStatus(status) or res.status(status).send(body) instead); req.param() is removed; res.redirect('back') is deprecated/removed; path-to-regexp is upgraded, changing wildcard routing behavior; body-parser is upgraded to v2.3.0, which throws on invalid limit values at initialization (fixing CVE-2026-12590); qs is upgraded to v6.16.0, fixing multiple CVEs (CVE-2026-2391, CVE-2026-82417, CVE-2026-82562); proxy-addr is upgraded to v2.0.8, fixing CVE-2026-90711. None of the analyzed usage sites in this repository are directly broken by these changes, as the limit option is valid, res.clearCookie does not use the ignored options, and no deprecated methods are called.

Node.js 18 is now the minimum supported version.
res.clearCookie() ignores expires and maxAge options.
res.send(status) and res.send(status, body) are removed.
req.param() is removed.
res.redirect('back') is deprecated/removed.
path-to-regexp is upgraded, changing wildcard routing behavior.
body-parser throws on invalid limit values at initialization.

Migration

Ensure the runtime environment uses Node.js 18 or higher.
Verify that any custom routing wildcards are compatible with the new path-to-regexp behavior.
Replace any occurrences of res.send(status) with res.sendStatus(status).
Replace any occurrences of req.param(name) with req.params.name, req.body.name, or req.query.name.
Replace any occurrences of res.redirect('back') with res.redirect(req.get('Referrer') || '/').

Confidence high. Model gemini-3.5-flash. It named no call site in this repository. Some inputs were truncated to fit the token budget.

Provenance