Release: 1.0.1

[UlisesGascon]

Plan to release it on Nov 06

What's included in the HISTORY.md

• Updated engines field to Node@18 or higher
• Remove dependency safe-buffer

What's Changed

• Remove dependency safe-buffer by @Phillip9587 in Remove dependency safe-buffer #53
• fix: update package.json engines field to reflect minimum supported node version by @Phillip9587 in fix: update package.json engines field to reflect minimum supported node version #56

New Contributors

• @Phillip9587 made their first contribution in Remove dependency safe-buffer #53

Full Changelog: v1.0.0...master

[UlisesGascon]

Current plan is to release it today.

[Phillip9587]

Hey @UlisesGascon , please consider adding #56 to the release. The commit removing the safe-buffer package is based on the assumption that only node versions v18 and newer are supported.

[UlisesGascon]

Added! thanks for the ping @Phillip9587 👍

[wesleytodd]

This should technically be a major. But, because it is our states support policy that engines should have been 18 on 1.0.0 release, I am willing to bend as long as we make this a minor (not patch like it is now).

[Phillip9587]

Hey @UlisesGascon, Just wanted to kindly check if there’s an ETA for when this release might go out? Looking forward to it!

[UlisesGascon]

Probably Jan'25 🎄

[Phillip9587]

Hey @UlisesGascon, just wanted to check in on the status of this release. This is the last of Express's direct dependencies that uses the safe-buffer package. I'm looking forward to removing it from our dependency tree :-)

[wesleytodd]

I will be assembling a list of releases we need to do next week. If @UlisesGascon doesn't time before then I can take this on. I will be doing two passes to make sure we release all the pending things for express first, then update them and release in express.

[wesleytodd]

There are two PRs we could land before we push this:

#55
#54

Neither required, just wanted to call them out.

[bjohansebas]

Now I'm not sure if the engine update will be in a patch or minor, but I'm sure it won't be in a patch.

[Phillip9587]

Hey @wesleytodd, @UlisesGascon, @bjohansebas, I created PR #68 that refactors the code to remove the dependency on node:path, which enhances compatibility with non-Node.js environments. Given this improvement, do you think it would be appropriate to include this change in this release and version it as v2? This would allow us to update the engines field accordingly and clearly communicate our support for a broader range of environments.

[wesleytodd]

Changing to a blocking review. We have a few other breaking changes we could land, and they would not even require a major when pulled into express. I would like to see us major for the engines change and since we have other breaking things to land I would like to see up do so before we do the next release (even if that means we went from 0.x to 1.0.0 to 2.0.0).

[Phillip9587]

@wesleytodd @UlisesGascon Would it be possible to release v1.0.1 without the engines field change, solely to remove safe-buffer from Express' dependency tree? According to HISTORY.md, support for Node <18 has already been dropped in the v1.0.0 release, so removing safe-buffer should be safe to include in a patch release - assuming we leave the engines field unchanged.

Notably, content-disposition is the last direct dependency of express still requiring safe-buffer. Here's the full dependency graph: https://npmgraph.js.org/?q=express

[Phillip9587]

@wesleytodd @UlisesGascon Would it be possible to release v1.0.1 without the engines field change, solely to remove safe-buffer from Express' dependency tree? According to HISTORY.md, support for Node <18 has already been dropped in the v1.0.0 release, so removing safe-buffer should be safe to include in a patch release - assuming we leave the engines field unchanged.

Notably, content-disposition is the last direct dependency of express still requiring safe-buffer. Here's the full dependency graph: https://npmgraph.js.org/?q=express

Hey @UlisesGascon @wesleytodd, what do you think?

[UlisesGascon]

We can revert that easily with #77 and just make this release semver compatible 👍

[Phillip9587]

@UlisesGascon Just a reminder - we also need to publish this release to the latest tag on npm. Currently v0.5.4 is still marked as the latest release on npm.

[Phillip9587]

Hey @UlisesGascon, I opened #79 to remove the invalid engines field. Could we move forward with releasing v1.0.1? Thanks!

[Phillip9587]

Hey @UlisesGascon @wesleytodd. Just wanted to check in on the status of this release. Has there been a decision?

[wesleytodd]

Really sorry for not noticing I was blocking this. Thanks for bringing it up again. We have since decided not to block on engines changes like that if it was intended to go out with the major.

[Phillip9587]

@wesleytodd Thanks for the approval. @UlisesGascon Can we publish this release?