outdated dependencies

[UlisesGascon]

👉 SEE

[dougwilson]

Yea, we can look at updating them :) for the non dev ones, would you be willing to list what all has chaned in each one so we can determine if updating it would be a patch version, minor version, or major version for express? For example cookie-signature drops support for Node.js less than 6.6 I believe making it a major version bump for express. Getting the details for each one of thos will help plan.

We'd want to split into the three version buckets so we can make the relevant releases which each type of change. We need to gather what the differences are anyway for HISTORY.md file.

[UlisesGascon]

Thanks for the fast replay @dougwilson!

Sure. I will create new PRs follow your advise. As we are looking to support old nodejs version (0.10) I will investigate each of them to see how far I can go with the upgrade and create separete PRs 👍

After that I will open an issue for branch 5.0. There I will use a different strategy as I assume we only need to support v10. Maybe I can wait until branch 5.0 got updated with master changes?, seems like last sync was at 5f0c829

[dougwilson]

Ah, yes, we will get 4.17 line into the 5.0 branch along with the router updates that will make up the beta.1 release this month.

Depending on how this dep updates shake out, we may do a patch 4.17, then merge into 5.0.

[UlisesGascon]

So, time for a new approach:

⚠️ Important

• This message will be changing once this issue is getting fix. So please refresh the browser before replay :-)

ℹ️ Context

• Outdated dependencies update is not an easy tasks at the current status of Express.
• I will use this issue (outdated dependencies #4171) to coordinate dependencies upgrade for version 4.x (not breaking with Nodejs v0.10)
• I will use a different issue (Not yet created) to coordinate dependencies upgrade for Express 5.x (not breaking with Nodejs v10)
• As suggest by @dougwilson, I will create a new PR per dependency in order to simplify the express bumping versioning and HISTORY.md sustainability.

🌮 Pending actions for @UlisesGascon

• Evaluate which libraries are in scope for this change (not development)
• Evaluate what are the latests non-breaking versions (compatible to v0.10)
• Create PRs per each one including impact evaluation (semver impact, changes to make, etc...) so the Express team can coordinate the next 4.x release w/o suffering ❤️
• Document the missing ones for further discussions and 5.x target

💪 Pending PRs

Extra context

• debug version 4.1.1 will break.
• qs version 6.9.1 is working but @dougwilson recommend 6.7.0. see
• safe-buffer version 5.2.0 is working but @dougwilson recommend 5.1.2. see
• debug update is not backwards-compatible. In scope for 5.0. see: deps: bump debug version to 3.2.6 #4173

Expected PRs

• array-flatten -> 2.1.2 (OK) -> 3.0.0 (Need work)
• path-to-regexp -> 6.1.0 (Need Work)
• cookie-signature -> 1.1.0 (OK) PR: Feature/4171 depd #4174
• depd -> 2.0.0 (OK) PR: Feature/4171 depd #4174
• setprototypeof -> 1.2.0 (OK) PR: Feature/4171 depd #4174

Notes:

List of libraries in scope for the current issue and derivate PRs:

In scope for v4.x

• array-flatten
• cookie-signature
• debug
• depd
• path-to-regexp
• qs
• safe-buffer
• setprototypeof

Out of scope

• connect-redis (due devDependencie)
• cookie-session (due devDependencie)
• ejs (due devDependencie)
• eslint (due devDependencie)
• express-session (due devDependencie)
• hbs (due devDependencie)
• marked (due devDependencie)
• mocha (due devDependencie)
• supertest (due devDependencie)

Starting point for Express 4.0

Just the npm outdatemessage for context. Nothing else ;-)

Package           Current  Wanted  Latest  Location
array-flatten       1.1.1   1.1.1   3.0.0  express
connect-redis       3.4.1   3.4.1   4.0.4  express
cookie-session      1.3.3   1.3.3   1.4.0  express
cookie-signature    1.0.6   1.0.6   1.1.0  express
debug               2.6.9   2.6.9   4.1.1  express
depd                1.1.2   1.1.2   2.0.0  express
ejs                 2.6.1   2.6.1   3.0.1  express
eslint             2.13.1  2.13.1   6.8.0  express
express-session    1.16.1  1.16.1  1.17.0  express
hbs                 4.0.4   4.0.4   4.1.0  express
marked              0.6.2   0.6.2   0.8.0  express
mocha               5.2.0   5.2.0   7.0.1  express
path-to-regexp      0.1.7   0.1.7   6.1.0  express
qs                  6.7.0   6.7.0   6.9.1  express
safe-buffer         5.1.2   5.1.2   5.2.0  express
setprototypeof      1.1.1   1.1.1   1.2.0  express
supertest           3.3.0   3.3.0   4.0.2  express

Fancy bash script to simulate CI for Node v0.10