2025-02-03 Express TC Meeting

[github-actions]

Date/Time

Timezone	Date/Time
America/Los_Angeles	Mon 03-Feb-2025 12:00 (12:00 PM)
America/Denver	Mon 03-Feb-2025 13:00 (01:00 PM)
America/Chicago	Mon 03-Feb-2025 14:00 (02:00 PM)
America/New_York	Mon 03-Feb-2025 15:00 (03:00 PM)
Europe/London	Mon 03-Feb-2025 20:00 (08:00 PM)
Europe/Amsterdam	Mon 03-Feb-2025 21:00 (09:00 PM)
Europe/Moscow	Mon 03-Feb-2025 23:00 (11:00 PM)
Asia/Kolkata	Tue 04-Feb-2025 01:30 (01:30 AM)
Asia/Shanghai	Tue 04-Feb-2025 04:00 (04:00 AM)
Asia/Tokyo	Tue 04-Feb-2025 05:00 (05:00 AM)
Australia/Sydney	Tue 04-Feb-2025 07:00 (07:00 AM)

Or in your local time:

• https://www.timeanddate.com/worldclock/?iso=2025-02-03T20:00:00

Agenda

Extracted from tc agenda labelled issues and pull requests from expressjs/discussions prior to the meeting.

• Discussion: consolidating a linter within the project #327
• Add dependabot express#5435
• Proposal: Create an infrastructure file #324
• Next v5 minor release (update)
• ESM discussion, referencing the ADR

Invited

This meeting is open for anyone who wants to attend. Reminder to follow our Code of Conduct.

@expressjs/express-tc
@expressjs/triagers
@expressjs/security-wg

Links

• Minutes:

Joining the meeting

• link for participants: https://zoom-lfx.platform.linuxfoundation.org/meeting/95266714809?password=f37cff1b-cb3a-4a21-9425-210e4714c72e
• For those who just want to watch: https://www.youtube.com/@expressjs-official

[bjohansebas]

Hey @expressjs/express-tc, I’d like to work on the expressjs/generator to support Express 5 and land several PRs in that repository, I know there are people using it, and probably change the name to create-express.

Could you also give me access to the session repository so I can work on version 2? :)

[jonchurch]

Im working through the agenda and checking on items.

We've got a few that have been carried over for a while now. Is there anything actionable for these items in this meeting? They seem more like discussion items that decision items.

• Add Moderation Policy admin#6
• Socket.dev reports on all our repos security-wg#17
• And I think Add dependabot express#5435 ? (the PR is 1 year old tmr)

[jonchurch]

We discussed the dependabot PR, and agreed that Ulises can continue to work on that. He understands the concern of the group, which are noisey dependabot updates, using a caret for our own deps and being a library means that dep updates aren't really useful for us. I noted that we could investigate the security-updates config for dependabot on a weekly cadence, to be able to catch new releases for security patches.

[jonchurch]

From wes v5 minor update (associated issue expressjs/express#6316):

Cookies signature, tj/node-cookie-signature#36, there is a desire from the current maintainer to release the project and have it find a new home. We are okay taking it into the org.

finalhandler, there's some landed but unreleased changes. We are discussing adding engines and revving a v3. We don't have breaking changes in the v2 line, if you consider us supporting v18 for node as of 2.0 (which we documented but without engines). Wes proposes not major revving, leave the engines field PR open. We decided to go with wes' proposal (and we must delete the existing engines field which is wrong, it is set to >= 0.8.

[ctcpip]

@bjohansebas for now, you can simply fork the session repo

[jonchurch]

ESM Topic. We have an open ADR about this #323

We need to do more async discussion on this, we aren't saying that we'll block ESM but it can read that way.
Blake mentioned that we can call out that CJS is required, but ESM is optional

[jonchurch]

Generator. Wow this is due for a bigger discussion. We are not sure we want the maintenance burden in the team. So there's a door open for folks around the project/ecosystem to work together to make something (which sounds like fun)