## What's Changed * Update captains by @UlisesGascon in https://github.com/expressjs/express/pull/6027 * build: Node.js 23.0 by @bjohansebas in https://github.com/expressjs/express/pull/6075 * Add funding field (v5) by @bjohansebas in https://github.com/expressjs/express/pull/6064 * ✅ add discarded middleware test by @ctcpip in https://github.com/expressjs/express/pull/5819 * update homepage link http to https by @bjohansebas in https://github.com/expressjs/express/pull/5920 * Improve readme by @bjohansebas in https://github.com/expressjs/express/pull/5994 * Add bjohansebas as repo captain for expressjs.com by @crandmck in https://github.com/expressjs/express/pull/6058 * Remove Object.setPrototypeOf polyfill by @Phillip9587 in https://github.com/expressjs/express/pull/6081 * fix(buffer): use node:buffer instead of safe-buffer by @bhavya3024 in https://github.com/expressjs/express/pull/6071 * docs: Add DCO by @UlisesGascon in https://github.com/expressjs/express/pull/6048 * cleanup: remove promise support check from tests by @Phillip9587 in https://github.com/expressjs/express/pull/6148 * Use loop for acceptParams by @blakeembrey in https://github.com/expressjs/express/pull/6066 * Improve documentation step in release process by @bjohansebas in https://github.com/expressjs/express/pull/6150 * cleanup: remove unnecessary require for global Buffer by @Phillip9587 in https://github.com/expressjs/express/pull/6146 * cleanup: remove AsyncLocalStorage check by @Phillip9587 in https://github.com/expressjs/express/pull/6147 * update history.md for acceptParams change by @jonchurch in https://github.com/expressjs/express/pull/6177 * docs: add @rxmarbles to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/6151 * refactor: improve readability by @sazk07 in https://github.com/expressjs/express/pull/6173 * docs: clarify the security process in the triage role by @bjohansebas in https://github.com/expressjs/express/pull/6217 * chore: replace `methods` dependency with standard library by @jonkoops in https://github.com/expressjs/express/pull/6196 * Remove `utils-merge` dependency - use spread syntax instead by @Phillip9587 in https://github.com/expressjs/express/pull/6091 * fix(securite): fix vulnerabilities by @Abdel-Monaam-Aouini in https://github.com/expressjs/express/pull/6211 * refactor: prefix built-in node module imports by @slagiewka in https://github.com/expressjs/express/pull/6236 * fix: remove download size badges by @wesleytodd in https://github.com/expressjs/express/pull/6266 * Remove unused `depd` dependency by @jonkoops in https://github.com/expressjs/express/pull/6197 * fix: usage of `Invalid action input 'persist-credentials'` for `actions/setup-node@v4` in `ci.yml` by @hamirmahal in https://github.com/expressjs/express/pull/6256 * Add support for OSSF scorecard reporting by @UlisesGascon in https://github.com/expressjs/express/pull/5431 * docs: add @Phillip9587 to the triage team by @bjohansebas in https://github.com/expressjs/express/pull/6276 * fix: added a missing semicolon in css styles in examples/auth by @pr4j3sh in https://github.com/expressjs/express/pull/6297 * docs: include team email in the security policy by @UlisesGascon in https://github.com/expressjs/express/pull/6278 * refactor: simplify `normalizeTypes` function by @Ayoub-Mabrouk in https://github.com/expressjs/express/pull/6097 * ci: updated github actions ci workflow by @Phillip9587 in https://github.com/expressjs/express/pull/6314 * ci: fix npm install --include typo by @Phillip9587 in https://github.com/expressjs/express/pull/6324 * ci: updated scorecard actions by @Phillip9587 in https://github.com/expressjs/express/pull/6322 * build(deps): use carat notation for dependency versions by @dpopp07 in https://github.com/expressjs/express/pull/6317 * chore(deps): update `debug` to ^4.4.0 by @Phillip9587 in https://github.com/expressjs/express/pull/6313 * docs: retroactively note 5.0.0-beta.1 api change in history file by @dpopp07 in https://github.com/expressjs/express/pull/6333 * feat(deps): body-parser@^2.1.0 by @wesleytodd in https://github.com/expressjs/express/pull/6332 * feat(deps): router@^2.1.0 by @wesleytodd in https://github.com/expressjs/express/pull/6331 * Update repo captains by @UlisesGascon in https://github.com/expressjs/express/pull/6234 * deps: upgrade nyc by @agungjati in https://github.com/expressjs/express/pull/6122 * fix (deps): update deps by @wesleytodd in https://github.com/expressjs/express/pull/6337 * response: add support for ETag option in res.sendFile by @juanarbol in https://github.com/expressjs/express/pull/6073 * Update multiple links to use `https` instead of `http` by @Phillip9587 in https://github.com/expressjs/express/pull/6338 * Extend res.links() to allow adding multiple links with the same rel #2729 by @andvea in https://github.com/expressjs/express/pull/4885 * docs: update emeritus triagers by @UlisesGascon in https://github.com/expressjs/express/pull/6345 * docs: update guidance for triager nominations by @bjohansebas in https://github.com/expressjs/express/pull/6349 * docs: clarify guidelines for becoming a committer by @bjohansebas in https://github.com/expressjs/express/pull/6364 * Nominate @dpopp07 to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/6352 * fix(deps): qs@^6.14.0 by @wesleytodd in https://github.com/expressjs/express/pull/6374 * Add dependabot by @UlisesGascon in https://github.com/expressjs/express/pull/5435 * fix dependabot config by @bjohansebas in https://github.com/expressjs/express/pull/6392 * build(deps): bump github/codeql-action from 3.24.7 to 3.28.11 by @dependabot in https://github.com/expressjs/express/pull/6398 * build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot in https://github.com/expressjs/express/pull/6397 * feat(deps): finalhandler@2.1.0 by @wesleytodd in https://github.com/expressjs/express/pull/6373 * build(deps-dev): bump cookie-session from 2.0.0 to 2.1.0 by @dependabot in https://github.com/expressjs/express/pull/6399 * deps: body-parser@^2.2.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6419 * deps: type-is@^2.0.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6420 * deps: router@^2.2.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6417 * ci: use full SHAs for github action versions by @Phillip9587 in https://github.com/expressjs/express/pull/6415 * doc: remove @mertcanaltin from Triagers by @mertcanaltin in https://github.com/expressjs/express/pull/6408 * deps: serve-static@^2.2.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6418 * 5.1.0 by @wesleytodd in https://github.com/expressjs/express/pull/6425 ## New Contributors * @bhavya3024 made their first contribution in https://github.com/expressjs/express/pull/6071 * @jonkoops made their first contribution in https://github.com/expressjs/express/pull/6196 * @Abdel-Monaam-Aouini made their first contribution in https://github.com/expressjs/express/pull/6211 * @slagiewka made their first contribution in https://github.com/expressjs/express/pull/6236 * @hamirmahal made their first contribution in https://github.com/expressjs/express/pull/6256 * @pr4j3sh made their first contribution in https://github.com/expressjs/express/pull/6297 * @Ayoub-Mabrouk made their first contribution in https://github.com/expressjs/express/pull/6097 * @dpopp07 made their first contribution in https://github.com/expressjs/express/pull/6317 * @agungjati made their first contribution in https://github.com/expressjs/express/pull/6122 * @andvea made their first contribution in https://github.com/expressjs/express/pull/4885 * @dependabot made their first contribution in https://github.com/expressjs/express/pull/6398 **Full Changelog**: https://github.com/expressjs/express/compare/5.0.1...v5.1.0

## What's Changed * Add funding field (v4) by @bjohansebas in https://github.com/expressjs/express/pull/6065 * deps: path-to-regexp@0.1.11 by @blakeembrey in https://github.com/expressjs/express/pull/5956 * deps: bump path-to-regexp@0.1.12 by @jonchurch in https://github.com/expressjs/express/pull/6209 * Release: 4.21.2 by @UlisesGascon in https://github.com/expressjs/express/pull/6094 **Full Changelog**: https://github.com/expressjs/express/compare/4.21.1...4.21.2

## What's Changed * remove --bail from test script by @jonchurch in https://github.com/expressjs/express/pull/5962 * Nominate @bjohansebas to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/6009 * Link and update captains by @blakeembrey in https://github.com/expressjs/express/pull/6013 * Update `cookie` semver lock to address CVE-2024-47764 by @joshbuker in https://github.com/expressjs/express/pull/6017 * Release: 5.0.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6032 **Full Changelog**: https://github.com/expressjs/express/compare/v5.0.0...5.0.1

## What's Changed * Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in https://github.com/expressjs/express/pull/6029 * Release: 4.21.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6031 **Full Changelog**: https://github.com/expressjs/express/compare/4.21.0...4.21.1

## What's Changed * Deprecate `"back"` magic string in redirects by @blakeembrey in https://github.com/expressjs/express/pull/5935 * finalhandler@1.3.1 by @wesleytodd in https://github.com/expressjs/express/pull/5954 * fix(deps): serve-static@1.16.2 by @wesleytodd in https://github.com/expressjs/express/pull/5951 * Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in https://github.com/expressjs/express/pull/5946 ## New Contributors * @agadzinski93 made their first contribution in https://github.com/expressjs/express/pull/5946 **Full Changelog**: https://github.com/expressjs/express/compare/4.20.0...4.21.0

## What's Changed * 4.19.2 Staging by @wesleytodd in https://github.com/expressjs/express/pull/5561 * remove duplicate location test for data uri by @wesleytodd in https://github.com/expressjs/express/pull/5562 * feat: document beta releases expectations by @marco-ippolito in https://github.com/expressjs/express/pull/5565 * Cut down on duplicated CI runs by @jonchurch in https://github.com/expressjs/express/pull/5564 * Add a Threat Model by @UlisesGascon in https://github.com/expressjs/express/pull/5526 * Assign captain of encodeurl by @blakeembrey in https://github.com/expressjs/express/pull/5579 * Nominate jonchurch as repo captain for `http-errors`, `expressjs.com`, `morgan`, `cors`, `body-parser` by @jonchurch in https://github.com/expressjs/express/pull/5587 * docs: update Security.md by @inigomarquinez in https://github.com/expressjs/express/pull/5590 * docs: update triage nomination policy by @UlisesGascon in https://github.com/expressjs/express/pull/5600 * Add CodeQL (SAST) by @UlisesGascon in https://github.com/expressjs/express/pull/5433 * docs: add UlisesGascon as triage initiative captain by @UlisesGascon in https://github.com/expressjs/express/pull/5605 * Use object with null prototype for various app properties by @EvanHahn in https://github.com/expressjs/express/pull/4861 * deps: encodeurl@~2.0.0 by @blakeembrey in https://github.com/expressjs/express/pull/5569 * skip QUERY method test by @jonchurch in https://github.com/expressjs/express/pull/5628 * ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in https://github.com/expressjs/express/pull/5639 * add support Node.js@22 in the CI by @mertcanaltin in https://github.com/expressjs/express/pull/5627 * doc: add table of contents, tc/triager lists to readme by @mertcanaltin in https://github.com/expressjs/express/pull/5619 * List and sort all projects, add captains by @blakeembrey in https://github.com/expressjs/express/pull/5653 * Call callback once on listen error by @wesleytodd in https://github.com/expressjs/express/pull/3216 * docs: add @UlisesGascon as captain for cookie-parser by @UlisesGascon in https://github.com/expressjs/express/pull/5666 * ✨ bring back query tests for node 21 by @ctcpip in https://github.com/expressjs/express/pull/5690 * [v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` by @jonchurch in https://github.com/expressjs/express/pull/5672 * skip QUERY tests for Node 21 only, still not supported by @jonchurch in https://github.com/expressjs/express/pull/5695 * 📝 update people, add ctcpip to TC by @ctcpip in https://github.com/expressjs/express/pull/5683 * remove minor version pinning from ci by @jonchurch in https://github.com/expressjs/express/pull/5722 * Fix link variable use in attribution section of CODE OF CONDUCT by @IamLizu in https://github.com/expressjs/express/pull/5762 * Replace Appveyor windows testing with GHA by @jonchurch in https://github.com/expressjs/express/pull/5599 * Add OSSF Scorecard badge by @UlisesGascon in https://github.com/expressjs/express/pull/5436 * Throw on invalid status codes by @jonchurch in https://github.com/expressjs/express/pull/4212 * Use Array.flat instead of array-flatten by @almic in https://github.com/expressjs/express/pull/5677 * Adopt Node@18 as the minimum supported version by @UlisesGascon in https://github.com/expressjs/express/pull/5803 * Ignore `expires` and `maxAge` in `res.clearCookie()` by @jonchurch in https://github.com/expressjs/express/pull/5792 * send@1.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5786 * chore: upgrade `debug` dep from 3.10 to 4.3.6 by @carpasse in https://github.com/expressjs/express/pull/5829 * refactor: replace 'path-is-absolute' dep with node:path isAbsolute method by @carpasse in https://github.com/expressjs/express/pull/5830 * update scorecard link by @bjohansebas in https://github.com/expressjs/express/pull/5814 * Nominate @IamLizu to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/5836 * deps: path-to-regexp@0.1.8 by @blakeembrey in https://github.com/expressjs/express/pull/5603 * docs: specify new instructions for `question` and `discuss` by @IamLizu in https://github.com/expressjs/express/pull/5835 * 5.x: Upgrading `merge-descriptors` with allowing minors by @RobinTail in https://github.com/expressjs/express/pull/5782 * 4.x: Upgrade `merge-descriptors` dependency by @RobinTail in https://github.com/expressjs/express/pull/5781 * WIP: serve-static@2 by @wesleytodd in https://github.com/expressjs/express/pull/5790 * chore: upgrade qs dp from 6.11.0 to 6.13.0 by @carpasse in https://github.com/expressjs/express/pull/5847 * Upgrade cookie signature by @IamLizu in https://github.com/expressjs/express/pull/5833 * accepts@2 by @wesleytodd in https://github.com/expressjs/express/pull/5881 * mime-types@3 by @wesleytodd in https://github.com/expressjs/express/pull/5882 * type-is@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5883 * content-disposition@^1.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5884 * fix(deps): finalhandler@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5899 * path-to-regexp@0.1.10 by @blakeembrey in https://github.com/expressjs/express/pull/5902 * update to `fresh@^2.0.0` by @jonchurch in https://github.com/expressjs/express/pull/5916 * router@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5885 * Adopt Node@18 as the minimum supported version by @UlisesGascon in https://github.com/expressjs/express/pull/5595 * master -> 5.0 by @ctcpip in https://github.com/expressjs/express/pull/5785 * 🔧 update CI, remove unsupported versions, clean up by @ctcpip in https://github.com/expressjs/express/pull/5931 * Delete `back` as a magic string by @blakeembrey in https://github.com/expressjs/express/pull/5933 * Release 5.0 by @dougwilson in https://github.com/expressjs/express/pull/2237 ## New Contributors * @marco-ippolito made their first contribution in https://github.com/expressjs/express/pull/5565 * @inigomarquinez made their first contribution in https://github.com/expressjs/express/pull/5590 * @mertcanaltin made their first contribution in https://github.com/expressjs/express/pull/5627 * @ctcpip made their first contribution in https://github.com/expressjs/express/pull/5690 * @IamLizu made their first contribution in https://github.com/expressjs/express/pull/5762 * @almic made their first contribution in https://github.com/expressjs/express/pull/5677 * @carpasse made their first contribution in https://github.com/expressjs/express/pull/5829 * @bjohansebas made their first contribution in https://github.com/expressjs/express/pull/5814 * @RobinTail made their first contribution in https://github.com/expressjs/express/pull/5782 **Full Changelog**: https://github.com/expressjs/express/compare/v5.0.0-beta.3...v5.0.0 ## What's Changed * 4.19.2 Staging by @wesleytodd in https://github.com/expressjs/express/pull/5561 * remove duplicate location test for data uri by @wesleytodd in https://github.com/expressjs/express/pull/5562 * feat: document beta releases expectations by @marco-ippolito in https://github.com/expressjs/express/pull/5565 * Cut down on duplicated CI runs by @jonchurch in https://github.com/expressjs/express/pull/5564 * Add a Threat Model by @UlisesGascon in https://github.com/expressjs/express/pull/5526 * Assign captain of encodeurl by @blakeembrey in https://github.com/expressjs/express/pull/5579 * Nominate jonchurch as repo captain for `http-errors`, `expressjs.com`, `morgan`, `cors`, `body-parser` by @jonchurch in https://github.com/expressjs/express/pull/5587 * docs: update Security.md by @inigomarquinez in https://github.com/expressjs/express/pull/5590 * docs: update triage nomination policy by @UlisesGascon in https://github.com/expressjs/express/pull/5600 * Add CodeQL (SAST) by @UlisesGascon in https://github.com/expressjs/express/pull/5433 * docs: add UlisesGascon as triage initiative captain by @UlisesGascon in https://github.com/expressjs/express/pull/5605 * Use object with null prototype for various app properties by @EvanHahn in https://github.com/expressjs/express/pull/4861 * deps: encodeurl@~2.0.0 by @blakeembrey in https://github.com/expressjs/express/pull/5569 * skip QUERY method test by @jonchurch in https://github.com/expressjs/express/pull/5628 * ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in https://github.com/expressjs/express/pull/5639 * add support Node.js@22 in the CI by @mertcanaltin in https://github.com/expressjs/express/pull/5627 * doc: add table of contents, tc/triager lists to readme by @mertcanaltin in https://github.com/expressjs/express/pull/5619 * List and sort all projects, add captains by @blakeembrey in https://github.com/expressjs/express/pull/5653 * Call callback once on listen error by @wesleytodd in https://github.com/expressjs/express/pull/3216 * docs: add @UlisesGascon as captain for cookie-parser by @UlisesGascon in https://github.com/expressjs/express/pull/5666 * ✨ bring back query tests for node 21 by @ctcpip in https://github.com/expressjs/express/pull/5690 * [v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` by @jonchurch in https://github.com/expressjs/express/pull/5672 * skip QUERY tests for Node 21 only, still not supported by @jonchurch in https://github.com/expressjs/express/pull/5695 * 📝 update people, add ctcpip to TC by @ctcpip in https://github.com/expressjs/express/pull/5683 * remove minor version pinning from ci by @jonchurch in https://github.com/expressjs/express/pull/5722 * Fix link variable use in attribution section of CODE OF CONDUCT by @IamLizu in https://github.com/expressjs/express/pull/5762 * Replace Appveyor windows testing with GHA by @jonchurch in https://github.com/expressjs/express/pull/5599 * Add OSSF Scorecard badge by @UlisesGascon in https://github.com/expressjs/express/pull/5436 * Throw on invalid status codes by @jonchurch in https://github.com/expressjs/express/pull/4212 * Use Array.flat instead of array-flatten by @almic in https://github.com/expressjs/express/pull/5677 * Adopt Node@18 as the minimum supported version by @UlisesGascon in https://github.com/expressjs/express/pull/5803 * Ignore `expires` and `maxAge` in `res.clearCookie()` by @jonchurch in https://github.com/expressjs/express/pull/5792 * send@1.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5786 * chore: upgrade `debug` dep from 3.10 to 4.3.6 by @carpasse in https://github.com/expressjs/express/pull/5829 * refactor: replace 'path-is-absolute' dep with node:path isAbsolute method by @carpasse in https://github.com/expressjs/express/pull/5830 * update scorecard link by @bjohansebas in https://github.com/expressjs/express/pull/5814 * Nominate @IamLizu to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/5836 * deps: path-to-regexp@0.1.8 by @blakeembrey in https://github.com/expressjs/express/pull/5603 * docs: specify new instructions for `question` and `discuss` by @IamLizu in https://github.com/expressjs/express/pull/5835 * 5.x: Upgrading `merge-descriptors` with allowing minors by @RobinTail in https://github.com/expressjs/express/pull/5782 * 4.x: Upgrade `merge-descriptors` dependency by @RobinTail in https://github.com/expressjs/express/pull/5781 * WIP: serve-static@2 by @wesleytodd in https://github.com/expressjs/express/pull/5790 * chore: upgrade qs dp from 6.11.0 to 6.13.0 by @carpasse in https://github.com/expressjs/express/pull/5847 * Upgrade cookie signature by @IamLizu in https://github.com/expressjs/express/pull/5833 * accepts@2 by @wesleytodd in https://github.com/expressjs/express/pull/5881 * mime-types@3 by @wesleytodd in https://github.com/expressjs/express/pull/5882 * type-is@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5883 * content-disposition@^1.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5884 * fix(deps): finalhandler@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5899 * path-to-regexp@0.1.10 by @blakeembrey in https://github.com/expressjs/express/pull/5902 * update to `fresh@^2.0.0` by @jonchurch in https://github.com/expressjs/express/pull/5916 * router@^2.0.0 by @wesleytodd in https://github.com/expressjs/express/pull/5885 * Adopt Node@18 as the minimum supported version by @UlisesGascon in https://github.com/expressjs/express/pull/5595 * master -> 5.0 by @ctcpip in https://github.com/expressjs/express/pull/5785 * 🔧 update CI, remove unsupported versions, clean up by @ctcpip in https://github.com/expressjs/express/pull/5931 * Delete `back` as a magic string by @blakeembrey in https://github.com/expressjs/express/pull/5933 * Release 5.0 by @dougwilson in https://github.com/expressjs/express/pull/2237 ## New Contributors * @marco-ippolito made their first contribution in https://github.com/expressjs/express/pull/5565 * @inigomarquinez made their first contribution in https://github.com/expressjs/express/pull/5590 * @mertcanaltin made their first contribution in https://github.com/expressjs/express/pull/5627 * @ctcpip made their first contribution in https://github.com/expressjs/express/pull/5690 * @IamLizu made their first contribution in https://github.com/expressjs/express/pull/5762 * @almic made their first contribution in https://github.com/expressjs/express/pull/5677 * @carpasse made their first contribution in https://github.com/expressjs/express/pull/5829 * @bjohansebas made their first contribution in https://github.com/expressjs/express/pull/5814 * @RobinTail made their first contribution in https://github.com/expressjs/express/pull/5782 **Full Changelog**: https://github.com/expressjs/express/compare/v5.0.0-beta.3...v5.0.0

## What's Changed ### Important * IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`) * Remove link renderization in html while using `res.redirect` ### Other Changes * 4.19.2 Staging by @wesleytodd in https://github.com/expressjs/express/pull/5561 * remove duplicate location test for data uri by @wesleytodd in https://github.com/expressjs/express/pull/5562 * feat: document beta releases expectations by @marco-ippolito in https://github.com/expressjs/express/pull/5565 * Cut down on duplicated CI runs by @jonchurch in https://github.com/expressjs/express/pull/5564 * Add a Threat Model by @UlisesGascon in https://github.com/expressjs/express/pull/5526 * Assign captain of encodeurl by @blakeembrey in https://github.com/expressjs/express/pull/5579 * Nominate jonchurch as repo captain for `http-errors`, `expressjs.com`, `morgan`, `cors`, `body-parser` by @jonchurch in https://github.com/expressjs/express/pull/5587 * docs: update Security.md by @inigomarquinez in https://github.com/expressjs/express/pull/5590 * docs: update triage nomination policy by @UlisesGascon in https://github.com/expressjs/express/pull/5600 * Add CodeQL (SAST) by @UlisesGascon in https://github.com/expressjs/express/pull/5433 * docs: add UlisesGascon as triage initiative captain by @UlisesGascon in https://github.com/expressjs/express/pull/5605 * deps: encodeurl@~2.0.0 by @blakeembrey in https://github.com/expressjs/express/pull/5569 * skip QUERY method test by @jonchurch in https://github.com/expressjs/express/pull/5628 * ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in https://github.com/expressjs/express/pull/5639 * add support Node.js@22 in the CI by @mertcanaltin in https://github.com/expressjs/express/pull/5627 * doc: add table of contents, tc/triager lists to readme by @mertcanaltin in https://github.com/expressjs/express/pull/5619 * List and sort all projects, add captains by @blakeembrey in https://github.com/expressjs/express/pull/5653 * docs: add @UlisesGascon as captain for cookie-parser by @UlisesGascon in https://github.com/expressjs/express/pull/5666 * ✨ bring back query tests for node 21 by @ctcpip in https://github.com/expressjs/express/pull/5690 * [v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` by @jonchurch in https://github.com/expressjs/express/pull/5672 * skip QUERY tests for Node 21 only, still not supported by @jonchurch in https://github.com/expressjs/express/pull/5695 * 📝 update people, add ctcpip to TC by @ctcpip in https://github.com/expressjs/express/pull/5683 * remove minor version pinning from ci by @jonchurch in https://github.com/expressjs/express/pull/5722 * Fix link variable use in attribution section of CODE OF CONDUCT by @IamLizu in https://github.com/expressjs/express/pull/5762 * Replace Appveyor windows testing with GHA by @jonchurch in https://github.com/expressjs/express/pull/5599 * Add OSSF Scorecard badge by @UlisesGascon in https://github.com/expressjs/express/pull/5436 * update scorecard link by @bjohansebas in https://github.com/expressjs/express/pull/5814 * Nominate @IamLizu to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/5836 * deps: path-to-regexp@0.1.8 by @blakeembrey in https://github.com/expressjs/express/pull/5603 * docs: specify new instructions for `question` and `discuss` by @IamLizu in https://github.com/expressjs/express/pull/5835 * 4.x: Upgrade `merge-descriptors` dependency by @RobinTail in https://github.com/expressjs/express/pull/5781 * path-to-regexp@0.1.10 by @blakeembrey in https://github.com/expressjs/express/pull/5902 ## New Contributors * @marco-ippolito made their first contribution in https://github.com/expressjs/express/pull/5565 * @inigomarquinez made their first contribution in https://github.com/expressjs/express/pull/5590 * @mertcanaltin made their first contribution in https://github.com/expressjs/express/pull/5627 * @ctcpip made their first contribution in https://github.com/expressjs/express/pull/5690 * @bjohansebas made their first contribution in https://github.com/expressjs/express/pull/5814 **Full Changelog**: https://github.com/expressjs/express/compare/4.19.1...4.20.0

**Full Changelog**: https://github.com/expressjs/express/compare/5.0.0-beta.2...v5.0.0-beta.3