Release 4.16

[dougwilson]

This is a tracking issue for release 4.16.

Please keep feature requests in their own issues

If you want to make a comment on a particular change, please make the comment in the "Files changed" tab so comments are not lost during a rebase.

List of changes for release:

• Add express.json and express.urlencoded to parse bodies Add bodyParser back to express 4.x #2211
• Add "json escape" setting for res.json and res.jsonp Option to unicode escape <, >, and & in JSON output #3268 Add 'json escape' option to unicode escape <, >, and & #3269
• Add options to res.download res.download and dotfiles #3327 Request for request #3327, allowing res.download to supply options to res.sendFile #3370
• Improve error message when autoloading invalid view engine test: Made unit test passing with node-chakracore #3251
• Improve error messages when non-function provided as middleware Fix error message for route #3426
• Re-use options object for ETags Issue #3313: DRY up etag and wetag code. #3314 DRY up etag and wetag code in ./lib/utils.js #3313
• Skip Buffer encoding when not generating ETag for small response
• Support Node.js 8.x
• Upgrade content-type module to 1.0.4 to bring in performance updates
• Upgrade etag module to 1.8.1 to bring in a performance update
• Upgrade finalhandler module to 1.1.0 to bring in a performance update and no _header usage
• Upgrade parseurl module to 1.3.2 to bring in a performance update
• Upgrade proxy-addr module to 2.0.2 to bring in a performance update
• Upgrade qs module to 6.5.1 to bring in a performance update
• Upgrade send module to 0.16.0 to bring in some fixes, immutable option, new mime module deps: send 0.16.0 #3435
• Upgrade serve-static module to 1.13.0 to bring in send update and immutable option express.static - add support for cache-control: immutable #3197
• Upgrade setprototypeof to 1.1.0
• Upgrade utils-merge to 1.0.1
• Upgrade vary to 1.1.2 to bring in performance update deps: vary@~1.1.2 #3434
• Use safe-buffer for improved Buffer API

Testing this release

If you want to try out this release, you can install it with the following commands:

$ npm cache clean express
$ npm install expressjs/express#4.16

Owners/collaborators: please do not merge this PR :)

[dougwilson]

Due to #3432 I'm likely going to cut another 4.15 release, which means I'll need to rebase this again, though I still haven't finished the rebase from the first security injection :)

I also looked harder at the mime dependency on if there is any possible way to get it into a new 4.15 release, but that does not seem feasible without violating semver, since it would be a lot of work (almost to re-implementing mime) to undo the semver changes that was included in the release.

Getting a new mime 1.3.x is also not workable, because we are on 1.3.4 and one of the patch versions above that includes a change that is semver-minor to us, so there isn't a version number available for a surgical 1.3.x release of mime for us anyway.

[dougwilson]

Due to the influx of issues related to mime and the logistics of getting forwarded to no longer include < 0.1.2 in the semver range, I think this release should be accelerated, which will likely mean not including changes that were originally slated for 4.16 in order to get it out the door. This should allow a quality release of 4.16 shipped Thursday Sep 28 instead of Monday Oct 2.

[LinusU]

Just read thru the entire changeset and it looks stellar ✨ just in case you wanted another pair of 👀 on it 🙂