4.17.1 / 2019-05-25

- Revert "Improve error message for `null`/`undefined` to `res.status`"

# 4.17.0 / 2019-05-16

- Add `express.raw` to parse bodies into `Buffer`
- Add `express.text` to parse bodies into string
- Improve error message for non-strings to `res.sendFile`
- Improve error message for `null`/`undefined` to `res.status`
- Support multiple hosts in `X-Forwarded-Host`
- deps: accepts1.3.7
- deps: body-.nosp@m.pars.nosp@m.er@1..nosp@m.19.0
  - Add encoding MIK
  - Add petabyte (`pb`) support
  - Fix parsing array brackets after index
  - deps: bytes@3.1.0
  - deps: http-errors@1.7.2
  - deps: iconv.nosp@m.-lit.nosp@m.e@0.4.nosp@m..24
  - deps: qs@6.7.0
  - deps: raw-body@2.4.0
  - deps: type-is1.6.17
- deps: content-disposition@0.5.3
- deps: cookie@0.4.0
  - Add `SameSite=None` support
- deps: finalhandler1.1.2
  - Set stricter `Content-Security-Policy` header
  - deps: parseurl1.3.3
  - deps: statuses1.5.0
- deps: parseurl1.3.3
- deps: proxy-addr2.0.5
  - deps: ipaddr.js@1.9.0
- deps: qs@6.7.0
  - Fix parsing array brackets after index
- deps: range-parser1.2.1
- deps: send@.nosp@m.0.17.1
  - Set stricter CSP header in redirect & error responses
  - deps: http-errors1.7.2
  - deps: mime@1.6.0
  - deps: ms@2.1.1
  - deps: range-parser1.2.1
  - deps: statuses1.5.0
  - perf: remove redundant `path.normalize` call
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..14.1
  - Set stricter CSP header in redirect response
  - deps: parseurl1.3.3
  - deps: send@.nosp@m.0.17.1
- deps: setprototypeof@1.1.1
- deps: statuses1.5.0
  - Add `103 Early Hints`
- deps: type-is1.6.18
  - deps: mime-types2.1.24
  - perf: prevent internal `throw` on invalid type

# 4.16.4 / 2018-10-10

- Fix issue where `"Request aborted"` may be logged in `res.sendfile`
- Fix JSDoc for `Router` constructor
- deps: body-.nosp@m.pars.nosp@m.er@1..nosp@m.18.3
  - Fix deprecation warnings on Node.js 10+
  - Fix stack trace for strict json parse error
  - deps: depd1.1.2
  - deps: http-errors1.6.3
  - deps: iconv.nosp@m.-lit.nosp@m.e@0.4.nosp@m..23
  - deps: qs@6.5.2
  - deps: raw-body@2.3.3
  - deps: type-is1.6.16
- deps: proxy-addr2.0.4
  - deps: ipaddr.js@1.8.0
- deps: qs@6.5.2
- deps: safe-buffer@5.1.2

# 4.16.3 / 2018-03-12

- deps: accepts1.3.5
  - deps: mime-types2.1.18
- deps: depd1.1.2
  - perf: remove argument reassignment
- deps: encodeurl1.0.2
  - Fix encoding `%` as last character
- deps: finalhandler@1.1.1
  - Fix 404 output for bad / missing pathnames
  - deps: encodeurl1.0.2
  - deps: statuses1.4.0
- deps: proxy-addr2.0.3
  - deps: ipaddr.js@1.6.0
- deps: send@.nosp@m.0.16.2
  - Fix incorrect end tag in default error & redirects
  - deps: depd1.1.2
  - deps: encodeurl1.0.2
  - deps: statuses1.4.0
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..13.2
  - Fix incorrect end tag in redirects
  - deps: encodeurl1.0.2
  - deps: send@.nosp@m.0.16.2
- deps: statuses1.4.0
- deps: type-is1.6.16
  - deps: mime-types2.1.18

# 4.16.2 / 2017-10-09

- Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set
- perf: skip parsing of entire `X-Forwarded-Proto` header

# 4.16.1 / 2017-09-29

- deps: send@.nosp@m.0.16.1
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..13.1
  - Fix regression when `root` is incorrectly set to a file
  - deps: send@.nosp@m.0.16.1

# 4.16.0 / 2017-09-28

- Add `"json escape"` setting for `res.json` and `res.jsonp`
- Add `express.json` and `express.urlencoded` to parse bodies
- Add `options` argument to `res.download`
- Improve error message when autoloading invalid view engine
- Improve error messages when non-function provided as middleware
- Skip `Buffer` encoding when not generating ETag for small response
- Use `safe-buffer` for improved Buffer API
- deps: accepts1.3.4
  - deps: mime-types2.1.16
- deps: content-type1.0.4
  - perf: remove argument reassignment
  - perf: skip parameter parsing when no parameters
- deps: etag1.8.1
  - perf: replace regular expression with substring
- deps: finalhandler@1.1.0
  - Use `res.headersSent` when available
- deps: parseurl1.3.2
  - perf: reduce overhead for full URLs
  - perf: unroll the "fast-path" `RegExp`
- deps: proxy-addr2.0.2
  - Fix trimming leading / trailing OWS in `X-Forwarded-For`
  - deps: forwarded0.1.2
  - deps: ipaddr.js@1.5.2
  - perf: reduce overhead when no `X-Forwarded-For` header
- deps: qs@6.5.1
  - Fix parsing & compacting very deep objects
- deps: send@.nosp@m.0.16.0
  - Add 70 new types for file extensions
  - Add `immutable` option
  - Fix missing `</html>` in default error & redirects
  - Set charset as "UTF-8" for .js and .json
  - Use instance methods on steam to check for listeners
  - deps: mime@1.4.1
  - perf: improve path validation speed
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..13.0
  - Add 70 new types for file extensions
  - Add `immutable` option
  - Set charset as "UTF-8" for .js and .json
  - deps: send@.nosp@m.0.16.0
- deps: setprototypeof@1.1.0
- deps: utils-merge@1.0.1
- deps: vary1.1.2
  - perf: improve header token parsing speed
- perf: re-use options object when generating ETags
- perf: remove dead `.charset` set in `res.jsonp`

# 4.15.5 / 2017-09-24

- deps: debug@2.6.9
- deps: finalhandler1.0.6
  - deps: debug@2.6.9
  - deps: parseurl1.3.2
- deps: fresh@0.5.2
  - Fix handling of modified headers with invalid dates
  - perf: improve ETag match loop
  - perf: improve `If-None-Match` token parsing
- deps: send@.nosp@m.0.15.6
  - Fix handling of modified headers with invalid dates
  - deps: debug@2.6.9
  - deps: etag1.8.1
  - deps: fresh@0.5.2
  - perf: improve `If-Match` token parsing
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..12.6
  - deps: parseurl1.3.2
  - deps: send@.nosp@m.0.15.6
  - perf: improve slash collapsing

# 4.15.4 / 2017-08-06

- deps: debug@2.6.8
- deps: depd1.1.1
  - Remove unnecessary `Buffer` loading
- deps: finalhandler1.0.4
  - deps: debug@2.6.8
- deps: proxy-addr1.1.5
  - Fix array argument being altered
  - deps: ipaddr.js@1.4.0
- deps: qs@6.5.0
- deps: send@.nosp@m.0.15.4
  - deps: debug@2.6.8
  - deps: depd1.1.1
  - deps: http-errors1.6.2
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..12.4
  - deps: send@.nosp@m.0.15.4

# 4.15.3 / 2017-05-16

- Fix error when `res.set` cannot add charset to `Content-Type`
- deps: debug@2.6.7
  - Fix `DEBUG_MAX_ARRAY_LENGTH`
  - deps: ms@2.0.0
- deps: finalhandler1.0.3
  - Fix missing `</html>` in HTML document
  - deps: debug@2.6.7
- deps: proxy-addr1.1.4
  - deps: ipaddr.js@1.3.0
- deps: send@.nosp@m.0.15.3
  - deps: debug@2.6.7
  - deps: ms@2.0.0
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..12.3
  - deps: send@.nosp@m.0.15.3
- deps: type-is1.6.15
  - deps: mime-types2.1.15
- deps: vary1.1.1
  - perf: hoist regular expression

# 4.15.2 / 2017-03-06

- deps: qs@6.4.0
  - Fix regression parsing keys starting with `[`

# 4.15.1 / 2017-03-05

- deps: send@.nosp@m.0.15.1
  - Fix issue when `Date.parse` does not return `NaN` on invalid date
  - Fix strict violation in broken environments
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..12.1
  - Fix issue when `Date.parse` does not return `NaN` on invalid date
  - deps: send@.nosp@m.0.15.1

# 4.15.0 / 2017-03-01

- Add debug message when loading view engine
- Add `next("router")` to exit from router
- Fix case where `router.use` skipped requests routes did not
- Remove usage of `res._headers` private field
  - Improves compatibility with Node.js 8 nightly
- Skip routing when `req.url` is not set
- Use `o` in path debug to tell types apart
- Use `Object.create` to setup request & response prototypes
- Use `setprototypeof` module to replace `__proto__` setting
- Use `statuses` instead of `http` module for status messages
- deps: debug@2.6.1
  - Allow colors in workers
  - Deprecated `DEBUG_FD` environment variable set to `3` or higher
  - Fix error when running under React Native
  - Use same color for same namespace
  - deps: ms@0.7.2
- deps: etag1.8.0
  - Use SHA1 instead of MD5 for ETag hashing
  - Works with FIPS 140-2 OpenSSL configuration
- deps: finalhandler1.0.0
  - Fix exception when `err` cannot be converted to a string
  - Fully URL-encode the pathname in the 404
  - Only include the pathname in the 404 message
  - Send complete HTML document
  - Set ‘Content-Security-Policy: default-src 'self’` header
  - deps: debug@2.6.1
- deps: fresh@0.5.0
  - Fix false detection of `no-cache` request directive
  - Fix incorrect result when `If-None-Match` has both `*` and ETags
  - Fix weak `ETag` matching to match spec
  - perf: delay reading header values until needed
  - perf: enable strict mode
  - perf: hoist regular expressions
  - perf: remove duplicate conditional
  - perf: remove unnecessary boolean coercions
  - perf: skip checking modified time if ETag check failed
  - perf: skip parsing `If-None-Match` when no `ETag` header
  - perf: use `Date.parse` instead of `new Date`
- deps: qs@6.3.1
  - Fix array parsing from skipping empty values
  - Fix compacting nested arrays
- deps: send@.nosp@m.0.15.0
  - Fix false detection of `no-cache` request directive
  - Fix incorrect result when `If-None-Match` has both `*` and ETags
  - Fix weak `ETag` matching to match spec
  - Remove usage of `res._headers` private field
  - Support `If-Match` and `If-Unmodified-Since` headers
  - Use `res.getHeaderNames()` when available
  - Use `res.headersSent` when available
  - deps: debug@2.6.1
  - deps: etag1.8.0
  - deps: fresh@0.5.0
  - deps: http-errors1.6.1
- deps: serve.nosp@m.-sta.nosp@m.tic@1.nosp@m..12.0
  - Fix false detection of `no-cache` request directive
  - Fix incorrect result when `If-None-Match` has both `*` and ETags
  - Fix weak `ETag` matching to match spec
  - Remove usage of `res._headers` private field
  - Send complete HTML document in redirect response
  - Set default CSP header in redirect response
  - Support `If-Match` and `If-Unmodified-Since` headers
  - Use `res.getHeaderNames()` when available
  - Use `res.headersSent` when available
  - deps: send@.nosp@m.0.15.0
- perf: add fast match path for `*` route
- perf: improve `req.ips` performance

# 4.14.1 / 2017-01-28

- deps: content-disposition@0.5.2
- deps: finalhandler@0.5.1
  - Fix exception when `err.headers` is not an object
  - deps: statuses1.3.1
  - perf: hoist regular expressions
  - perf: remove duplicate validation path
- deps: proxy-addr1.1.3
  - deps: ipaddr.js@1.2.0
- deps: send@.nosp@m.0.14.2
  - deps: http-errors1.5.1
  - deps: ms@0.7.2
  - deps: statuses1.3.1
- deps: serve-static1.11.2
  - deps: send@.nosp@m.0.14.2
- deps: type-is1.6.14
  - deps: mime-types2.1.13

# 4.14.0 / 2016-06-16

- Add `acceptRanges` option to `res.sendFile`/`res.sendfile`
- Add `cacheControl` option to `res.sendFile`/`res.sendfile`
- Add `options` argument to `req.range`
  - Includes the `combine` option
- Encode URL in `res.location`/`res.redirect` if not already encoded
- Fix some redirect handling in `res.sendFile`/`res.sendfile`
- Fix Windows absolute path check using forward slashes
- Improve error with invalid arguments to `req.get()`
- Improve performance for `res.json`/`res.jsonp` in most cases
- Improve `Range` header handling in `res.sendFile`/`res.sendfile`
- deps: accepts1.3.3
  - Fix including type extensions in parameters in `Accept` parsing
  - Fix parsing `Accept` parameters with quoted equals
  - Fix parsing `Accept` parameters with quoted semicolons
  - Many performance improvements
  - deps: mime-types2.1.11
  - deps: negotiator@0.6.1
- deps: content-type1.0.2
  - perf: enable strict mode
- deps: cookie@0.3.1
  - Add `sameSite` option
  - Fix cookie `Max-Age` to never be a floating point number
  - Improve error message when `encode` is not a function
  - Improve error message when `expires` is not a `Date`
  - Throw better error for invalid argument to parse
  - Throw on invalid values provided to `serialize`
  - perf: enable strict mode
  - perf: hoist regular expression
  - perf: use for loop in parse
  - perf: use string concatenation for serialization
- deps: finalhandler@0.5.0
  - Change invalid or non-numeric status code to 500
  - Overwrite status message to match set status code
  - Prefer `err.statusCode` if `err.status` is invalid
  - Set response headers from `err.headers` object
  - Use `statuses` instead of `http` module for status messages
- deps: proxy-addr1.1.2
  - Fix accepting various invalid netmasks
  - Fix IPv6-mapped IPv4 validation edge cases
  - IPv4 netmasks must be contiguous
  - IPv6 addresses cannot be used as a netmask
  - deps: ipaddr.js@1.1.1
- deps: qs@6.2.0
  - Add `decoder` option in `parse` function
- deps: range-parser1.2.0
  - Add `combine` option to combine overlapping ranges
  - Fix incorrectly returning -1 when there is at least one valid range
  - perf: remove internal function
- deps: send@.nosp@m.0.14.1
  - Add `acceptRanges` option
  - Add `cacheControl` option
  - Attempt to combine multiple ranges into single range
  - Correctly inherit from `Stream` class
  - Fix `Content-Range` header in 416 responses when using `start`/`end` options
  - Fix `Content-Range` header missing from default 416 responses
  - Fix redirect error when `path` contains raw non-URL characters
  - Fix redirect when `path` starts with multiple forward slashes
  - Ignore non-byte `Range` headers
  - deps: http-errors1.5.0
  - deps: range-parser1.2.0
  - deps: statuses1.3.0
  - perf: remove argument reassignment
- deps: serve-static1.11.1
  - Add `acceptRanges` option
  - Add `cacheControl` option
  - Attempt to combine multiple ranges into single range
  - Fix redirect error when `req.url` contains raw non-URL characters
  - Ignore non-byte `Range` headers
  - Use status code 301 for redirects
  - deps: send@.nosp@m.0.14.1
- deps: type-is1.6.13
  - Fix type error when given invalid type to match against
  - deps: mime-types2.1.11
- deps: vary1.1.0
  - Only accept valid field names in the `field` argument
- perf: use strict equality when possible

# 4.13.4 / 2016-01-21

- deps: content-disposition@0.5.1
  - perf: enable strict mode
- deps: cookie@0.1.5
  - Throw on invalid values provided to `serialize`
- deps: depd1.1.0
  - Support web browser loading
  - perf: enable strict mode
- deps: escape-html1.0.3
  - perf: enable strict mode
  - perf: optimize string replacement
  - perf: use faster string coercion
- deps: finalhandler@0.4.1
  - deps: escape-html1.0.3
- deps: merge-descriptors@1.0.1
  - perf: enable strict mode
- deps: methods1.1.2
  - perf: enable strict mode
- deps: parseurl1.3.1
  - perf: enable strict mode
- deps: proxy-addr1.0.10
  - deps: ipaddr.js@1.0.5
  - perf: enable strict mode
- deps: range-parser1.0.3
  - perf: enable strict mode
- deps: send@.nosp@m.0.13.1
  - deps: depd1.1.0
  - deps: destroy1.0.4
  - deps: escape-html1.0.3
  - deps: range-parser1.0.3
- deps: serve-static1.10.2
  - deps: escape-html1.0.3
  - deps: parseurl1.3.0
  - deps: send@.nosp@m.0.13.1

# 4.13.3 / 2015-08-02

- Fix infinite loop condition using `mergeParams: true`
- Fix inner numeric indices incorrectly altering parent `req.params`

# 4.13.2 / 2015-07-31

- deps: accepts1.2.12
  - deps: mime-types2.1.4
- deps: array-flatten@1.1.1
  - perf: enable strict mode
- deps: path-to-regexp@0.1.7
  - Fix regression with escaped round brackets and matching groups
- deps: type-is1.6.6
  - deps: mime-types2.1.4

# 4.13.1 / 2015-07-05

- deps: accepts1.2.10
  - deps: mime-types2.1.2
- deps: qs@4.0.0
  - Fix dropping parameters like `hasOwnProperty`
  - Fix various parsing edge cases
- deps: type-is1.6.4
  - deps: mime-types2.1.2
  - perf: enable strict mode
  - perf: remove argument reassignment

# 4.13.0 / 2015-06-20

- Add settings to debug output
- Fix `res.format` error when only `default` provided
- Fix issue where ‘next('route’)`in`app.param<tt>would incorrectly skip values
- Fix hiding platform issues withdecodeURIComponent`
  - OnlyURIError`s are a 400`
  `
- ``Fix using`*` before params in routes`
- `Fix using capture groups before params in routes`
- `Simplify `res.cookie` to call `res.append``
- `Use `array-flatten` module for flattening arrays`
- `deps: accepts1.2.9
  - deps: mime-types2.1.1
  - perf: avoid argument reassignment & argument slice
  - perf: avoid negotiator recursive construction
  - perf: enable strict mode
  - perf: remove unnecessary bitwise operator
  `
- `deps: cookie@0.1.3
  - perf: deduce the scope of try-catch deopt
  - perf: remove argument reassignments
  `
- `deps: escape-html@1.0.2`
- `deps: etag1.7.0
  - Always include entity length in ETags for hash length extensions
  - Generate non-Stats ETags using MD5 only (no longer CRC32)
  - Improve stat performance by removing hashing
  - Improve support for JXcore
  - Remove base64 padding in ETags to shorten
  - Support "fake" stats objects in environments without fs
  - Use MD5 instead of MD4 in weak ETags over 1KB
  `
- `deps: finalhandler@0.4.0
  - Fix a false-positive when unpiping in Node.js 0.8
  - Support `statusCode` property on `Error` objects
  - Use `unpipe` module for unpiping requests
  - deps: escape-html@1.0.2
  - deps: on-finished2.3.0
  - perf: enable strict mode
  - perf: remove argument reassignment
  `
- `deps: fresh@0.3.0
  - Add weak `ETag` matching support
  `
- `deps: on-finished2.3.0
  - Add defined behavior for HTTP `CONNECT` requests
  - Add defined behavior for HTTP `Upgrade` requests
  - deps: ee-first@1.1.1
  `
- `deps: path-to-regexp@0.1.6`
- `deps: send@.nosp@m.0.13.0
  - Allow Node.js HTTP server to set `Date` response header
  - Fix incorrectly removing `Content-Location` on 304 response
  - Improve the default redirect response headers
  - Send appropriate headers on default error response
  - Use `http-errors` for standard emitted errors
  - Use `statuses` instead of `http` module for status messages
  - deps: escape-html@1.0.2
  - deps: etag1.7.0
  - deps: fresh@0.3.0
  - deps: on-finished2.3.0
  - perf: enable strict mode
  - perf: remove unnecessary array allocations
  `
- `deps: serve-static1.10.0
  - Add `fallthrough` option
  - Fix reading options from options prototype
  - Improve the default redirect response headers
  - Malformed URLs now `next()` instead of 400
  - deps: escape-html@1.0.2
  - deps: send@.nosp@m.0.13.0
  - perf: enable strict mode
  - perf: remove argument reassignment
  `
- `deps: type-is1.6.3
  - deps: mime-types2.1.1
  - perf: reduce try block size
  - perf: remove bitwise operations
  `
- `perf: enable strict mode`
- `perf: isolate `app.render` try block`
- `perf: remove argument reassignments in application`
- `perf: remove argument reassignments in request prototype`
- `perf: remove argument reassignments in response prototype`
- `perf: remove argument reassignments in routing`
- `perf: remove argument reassignments in `View``
- `perf: skip attempting to decode zero length string`
- `perf: use saved reference to `http.STATUS_CODES``

``

# 4.12.4 / 2015-05-17

``

``

- deps: accepts1.2.7
  - deps: mime-types2.0.11
  - deps: negotiator@0.5.3
- deps: debug2.2.0
  - deps: ms@0.7.1
- deps: depd1.0.1
- deps: etag1.6.0
  - Improve support for JXcore
  - Support "fake" stats objects in environments without `fs`
- deps: finalhandler@0.3.6
  - deps: debug2.2.0
  - deps: on-finished2.2.1
- deps: on-finished2.2.1
  - Fix `isFinished(req)` when data buffered
- deps: proxy-addr1.0.8
  - deps: ipaddr.js@1.0.1
- deps: qs@2.4.2
  - Fix allowing parameters like `constructor`
- deps: send@.nosp@m.0.12.3
  - deps: debug2.2.0
  - deps: depd1.0.1
  - deps: etag1.6.0
  - deps: ms@0.7.1
  - deps: on-finished2.2.1
- deps: serve-static1.9.3
  - deps: send@.nosp@m.0.12.3
- deps: type-is1.6.2
  - deps: mime-types2.0.11

``

# 4.12.3 / 2015-03-17

``

``

- deps: accepts1.2.5
  - deps: mime-types2.0.10
- deps: debug2.1.3
  - Fix high intensity foreground color for bold
  - deps: ms@0.7.0
- deps: finalhandler@0.3.4
  - deps: debug2.1.3
- deps: proxy-addr1.0.7
  - deps: ipaddr.js@0.1.9
- deps: qs@2.4.1
  - Fix error when parameter `hasOwnProperty` is present
- deps: send@.nosp@m.0.12.2
  - Throw errors early for invalid `extensions` or `index` options
  - deps: debug2.1.3
- deps: serve-static1.9.2
  - deps: send@.nosp@m.0.12.2
- deps: type-is1.6.1
  - deps: mime-types2.0.10

``

# 4.12.2 / 2015-03-02

``

``

- Fix regression where `"Request aborted"` is logged using `res.sendFile`

``

# 4.12.1 / 2015-03-01

``

``

- Fix constructing application with non-configurable prototype properties
- Fix `ECONNRESET` errors from `res.sendFile` usage
- Fix `req.host` when using "trust proxy" hops count
- Fix `req.protocol`/`req.secure` when using "trust proxy" hops count
- Fix wrong `code` on aborted connections from `res.sendFile`
- deps: merge-descriptors@1.0.0

``

# 4.12.0 / 2015-02-23

``

``

- Fix `"trust proxy"` setting to inherit when app is mounted
- Generate `ETag`s for all request responses
  - No longer restricted to only responses for `GET` and `HEAD` requests
- Use `content-type` to parse `Content-Type` headers
- deps: accepts1.2.4
  - Fix preference sorting to be stable for long acceptable lists
  - deps: mime-types2.0.9
  - deps: negotiator@0.5.1
- deps: cookie-signature@1.0.6
- deps: send@.nosp@m.0.12.1
  - Always read the stat size from the file
  - Fix mutating passed-in `options`
  - deps: mime@1.3.4
- deps: serve-static1.9.1
  - deps: send@.nosp@m.0.12.1
- deps: type-is1.6.0
  - fix argument reassignment
  - fix false-positives in `hasBody` `Transfer-Encoding` check
  - support wildcard for both type and subtype (`*/*`)
  - deps: mime-types2.0.9

``

# 4.11.2 / 2015-02-01

``

``

- Fix `res.redirect` double-calling `res.end` for `HEAD` requests
- deps: accepts1.2.3
  - deps: mime-types2.0.8
- deps: proxy-addr1.0.6
  - deps: ipaddr.js@0.1.8
- deps: type-is1.5.6
  - deps: mime-types2.0.8

``

# 4.11.1 / 2015-01-20

``

``

- deps: send@.nosp@m.0.11.1
  - Fix root path disclosure
- deps: serve-static1.8.1
  - Fix redirect loop in Node.js 0.11.14
  - Fix root path disclosure
  - deps: send@.nosp@m.0.11.1

``

# 4.11.0 / 2015-01-13

``

``

- Add `res.append(field, val)` to append headers
- Deprecate leading `:` in `name` for `app.param(name, fn)`
- Deprecate `req.param()` – use `req.params`, `req.body`, or `req.query` instead
- Deprecate `app.param(fn)`
- Fix `OPTIONS` responses to include the `HEAD` method properly
- Fix `res.sendFile` not always detecting aborted connection
- Match routes iteratively to prevent stack overflows
- deps: accepts1.2.2
  - deps: mime-types2.0.7
  - deps: negotiator@0.5.0
- deps: send@.nosp@m.0.11.0
  - deps: debug2.1.1
  - deps: etag1.5.1
  - deps: ms@0.7.0
  - deps: on-finished2.2.0
- deps: serve-static1.8.0
  - deps: send@.nosp@m.0.11.0

``

# 4.10.8 / 2015-01-13

``

``

- Fix crash from error within `OPTIONS` response handler
- deps: proxy-addr1.0.5
  - deps: ipaddr.js@0.1.6

``

# 4.10.7 / 2015-01-04

``

``

- Fix `Allow` header for `OPTIONS` to not contain duplicate methods
- Fix incorrect "Request aborted" for `res.sendFile` when `HEAD` or 304
- deps: debug2.1.1
- deps: finalhandler@0.3.3
  - deps: debug2.1.1
  - deps: on-finished2.2.0
- deps: methods1.1.1
- deps: on-finished2.2.0
- deps: serve-static1.7.2
  - Fix potential open redirect when mounted at root
- deps: type-is1.5.5
  - deps: mime-types2.0.7

``

# 4.10.6 / 2014-12-12

``

``

- Fix exception in `req.fresh`/`req.stale` without response headers

``

# 4.10.5 / 2014-12-10

``

``

- Fix `res.send` double-calling `res.end` for `HEAD` requests
- deps: accepts1.1.4
  - deps: mime-types2.0.4
- deps: type-is1.5.4
  - deps: mime-types2.0.4

``

# 4.10.4 / 2014-11-24

``

``

- Fix `res.sendfile` logging standard write errors

``

# 4.10.3 / 2014-11-23

``

``

- Fix `res.sendFile` logging standard write errors
- deps: etag1.5.1
- deps: proxy-addr1.0.4
  - deps: ipaddr.js@0.1.5
- deps: qs@2.3.3
  - Fix `arrayLimit` behavior

``

# 4.10.2 / 2014-11-09

``

``

- Correctly invoke async router callback asynchronously
- deps: accepts1.1.3
  - deps: mime-types2.0.3
- deps: type-is1.5.3
  - deps: mime-types2.0.3

``

# 4.10.1 / 2014-10-28

``

``

- Fix handling of URLs containing `://` in the path
- deps: qs@2.3.2
  - Fix parsing of mixed objects and values

``

# 4.10.0 / 2014-10-23

``

``

- Add support for ‘app.set('views’, array)`
  - Views are looked up in sequence in array of directories
- Fix `res.send(status)` to mention `res.sendStatus(status)`
- Fix handling of invalid empty URLs
- Use `content-disposition` module for `res.attachment`/`res.download`
  - Sends standards-compliant `Content-Disposition` header
  - Full Unicode support
- Use `path.resolve` in view lookup
- deps: debug2.1.0
  - Implement `DEBUG_FD` env variable support
- deps: depd1.0.0
- deps: etag1.5.0
  - Improve string performance
  - Slightly improve speed for weak ETags over 1KB
- deps: finalhandler@0.3.2
  - Terminate in progress response only on error
  - Use `on-finished` to determine request status
  - deps: debug2.1.0
  - deps: on-finished2.1.1
- deps: on-finished2.1.1
  - Fix handling of pipelined requests
- deps: qs@2.3.0
  - Fix parsing of mixed implicit and explicit arrays
- deps: send@.nosp@m.0.10.1
  - deps: debug2.1.0
  - deps: depd1.0.0
  - deps: etag1.5.0
  - deps: on-finished2.1.1
- deps: serve-static1.7.1
  - deps: send@.nosp@m.0.10.1

``

# 4.9.8 / 2014-10-17

``

``

- Fix `res.redirect` body when redirect status specified
- deps: accepts1.1.2
  - Fix error when media type has invalid parameter
  - deps: negotiator@0.4.9

``

# 4.9.7 / 2014-10-10

``

``

- Fix using same param name in array of paths

``

# 4.9.6 / 2014-10-08

``

``

- deps: accepts1.1.1
  - deps: mime-types2.0.2
  - deps: negotiator@0.4.8
- deps: serve-static1.6.4
  - Fix redirect loop when index file serving disabled
- deps: type-is1.5.2
  - deps: mime-types2.0.2

``

# 4.9.5 / 2014-09-24

``

``

- deps: etag1.4.0
- deps: proxy-addr1.0.3
  - Use `forwarded` npm module
- deps: send@0.9.3
  - deps: etag1.4.0
- deps: serve-static1.6.3
  - deps: send@0.9.3

``

# 4.9.4 / 2014-09-19

``

``

- deps: qs@2.2.4
  - Fix issue with object keys starting with numbers truncated

``

# 4.9.3 / 2014-09-18

``

``

- deps: proxy-addr1.0.2
  - Fix a global leak when multiple subnets are trusted
  - deps: ipaddr.js@0.1.3

``

# 4.9.2 / 2014-09-17

``

``

- Fix regression for empty string `path` in `app.use`
- Fix `router.use` to accept array of middleware without path
- Improve error message for bad `app.use` arguments

``

# 4.9.1 / 2014-09-16

``

``

- Fix `app.use` to accept array of middleware without path
- deps: depd@0.4.5
- deps: etag1.3.1
- deps: send@0.9.2
  - deps: depd@0.4.5
  - deps: etag1.3.1
  - deps: range-parser1.0.2
- deps: serve-static1.6.2
  - deps: send@0.9.2

``

# 4.9.0 / 2014-09-08

``

``

- Add `res.sendStatus`
- Invoke callback for sendfile when client aborts
  - Applies to `res.sendFile`, `res.sendfile`, and `res.download`
  - `err` will be populated with request aborted error
- Support IP address host in `req.subdomains`
- Use `etag` to generate `ETag` headers
- deps: accepts1.1.0
  - update `mime-types`
- deps: cookie-signature@1.0.5
- deps: debug2.0.0
- deps: finalhandler@0.2.0
  - Set `X-Content-Type-Options: nosniff` header
  - deps: debug2.0.0
- deps: fresh@0.2.4
- deps: media-typer@0.3.0
  - Throw error when parameter format invalid on parse
- deps: qs@2.2.3
  - Fix issue where first empty value in array is discarded
- deps: range-parser1.0.2
- deps: send@0.9.1
  - Add `lastModified` option
  - Use `etag` to generate `ETag` header
  - deps: debug2.0.0
  - deps: fresh@0.2.4
- deps: serve-static1.6.1
  - Add `lastModified` option
  - deps: send@0.9.1
- deps: type-is1.5.1
  - fix `hasbody` to be true for `content-length: 0`
  - deps: media-typer@0.3.0
  - deps: mime-types2.0.1
- deps: vary1.0.0
  - Accept valid `Vary` header string as `field`

``

# 4.8.8 / 2014-09-04

``

``

- deps: send@0.8.5
  - Fix a path traversal issue when using `root`
  - Fix malicious path detection for empty string path
- deps: serve-static1.5.4
  - deps: send@0.8.5

``

# 4.8.7 / 2014-08-29

``

``

- deps: qs@2.2.2
  - Remove unnecessary cloning

``

# 4.8.6 / 2014-08-27

``

``

- deps: qs@2.2.0
  - Array parsing fix
  - Performance improvements

``

# 4.8.5 / 2014-08-18

``

``

- deps: send@0.8.3
  - deps: destroy@1.0.3
  - deps: on-finished@2.1.0
- deps: serve-static1.5.3
  - deps: send@0.8.3

``

# 4.8.4 / 2014-08-14

``

``

- deps: qs@1.2.2
- deps: send@0.8.2
  - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`
- deps: serve-static1.5.2
  - deps: send@0.8.2

``

# 4.8.3 / 2014-08-10

``

``

- deps: parseurl1.3.0
- deps: qs@1.2.1
- deps: serve-static1.5.1
  - Fix parsing of weird `req.originalUrl` values
  - deps: parseurl1.3.0
  - deps: utils-merge@1.0.0

``

# 4.8.2 / 2014-08-07

``

``

- deps: qs@1.2.0
  - Fix parsing array of objects

``

# 4.8.1 / 2014-08-06

``

``

- fix incorrect deprecation warnings on `res.download`
- deps: qs@1.1.0
  - Accept urlencoded square brackets
  - Accept empty values in implicit array notation

``

# 4.8.0 / 2014-08-05

``

``

- add `res.sendFile`
  - accepts a file system path instead of a URL
  - requires an absolute path or `root` option specified
- deprecate `res.sendfile` – use `res.sendFile` instead
- support mounted app as any argument to `app.use()`
- deps: qs@1.0.2
  - Complete rewrite
  - Limits array length to 20
  - Limits object depth to 5
  - Limits parameters to 1,000
- deps: send@0.8.1
  - Add `extensions` option
- deps: serve-static1.5.0
  - Add `extensions` option
  - deps: send@0.8.1

``

# 4.7.4 / 2014-08-04

``

``

- fix `res.sendfile` regression for serving directory index files
- deps: send@0.7.4
  - Fix incorrect 403 on Windows and Node.js 0.11
  - Fix serving index files without root dir
- deps: serve-static1.4.4
  - deps: send@0.7.4

``

# 4.7.3 / 2014-08-04

``

``

- deps: send@0.7.3
  - Fix incorrect 403 on Windows and Node.js 0.11
- deps: serve-static1.4.3
  - Fix incorrect 403 on Windows and Node.js 0.11
  - deps: send@0.7.3

``

# 4.7.2 / 2014-07-27

``

``

- deps: depd@0.4.4
  - Work-around v8 generating empty stack traces
- deps: send@0.7.2
  - deps: depd@0.4.4
- deps: serve-static1.4.2

``

# 4.7.1 / 2014-07-26

``

``

- deps: depd@0.4.3
  - Fix exception when global `Error.stackTraceLimit` is too low
- deps: send@0.7.1
  - deps: depd@0.4.3
- deps: serve-static1.4.1

``

# 4.7.0 / 2014-07-25

``

``

- fix `req.protocol` for proxy-direct connections
- configurable query parser with ‘app.set('query parser’, parser)`-`app.set('query parser', 'extended')`parse with "qs" module -`app.set('query parser', 'simple')`parse with "querystring" core module -`app.set('query parser', false)`disable query string parsing -`app.set('query parser', true)`enable simple parsing`
- `deprecate`res.json(status, obj)`-- use`res.status(status).json(obj)`instead`
- `deprecate`res.jsonp(status, obj)`-- use`res.status(status).jsonp(obj)`instead`
- `deprecate`res.send(status, body)`-- use`res.status(status).send(body)` instead
- deps: debug@1.0.4
- deps: depd@0.4.2
  - Add `TRACE_DEPRECATION` environment variable
  - Remove non-standard grey color from color output
  - Support `--no-deprecation` argument
  - Support `--trace-deprecation` argument
- deps: finalhandler@0.1.0
  - Respond after request fully read
  - deps: debug@1.0.4
- deps: parseurl1.2.0
  - Cache URLs based on original value
  - Remove no-longer-needed URL mis-parse work-around
  - Simplify the "fast-path" `RegExp`
- deps: send@0.7.0
  - Add `dotfiles` option
  - Cap `maxAge` value to 1 year
  - deps: debug@1.0.4
  - deps: depd@0.4.2
- deps: serve-static1.4.0
  - deps: parseurl1.2.0
  - deps: send@0.7.0
- perf: prevent multiple `Buffer` creation in `res.send`

``

# 4.6.1 / 2014-07-12

``

``

- fix `subapp.mountpath` regression for `app.use(subapp)`

``

# 4.6.0 / 2014-07-11

``

``

- accept multiple callbacks to `app.use()`
- add explicit "Rosetta Flash JSONP abuse" protection
  - previous versions are not vulnerable; this is just explicit protection
- catch errors in multiple `req.param(name, fn)` handlers
- deprecate `res.redirect(url, status)` – use `res.redirect(status, url)` instead
- fix `res.send(status, num)` to send `num` as json (not error)
- remove unnecessary escaping when `res.jsonp` returns JSON response
- support non-string `path` in `app.use(path, fn)`
  - supports array of paths
  - supports `RegExp`
- router: fix optimization on router exit
- router: refactor location of `try` blocks
- router: speed up standard `app.use(fn)`
- deps: debug@1.0.3
  - Add support for multiple wildcards in namespaces
- deps: finalhandler@0.0.3
  - deps: debug@1.0.3
- deps: methods@1.1.0
  - add `CONNECT`
- deps: parseurl1.1.3
  - faster parsing of href-only URLs
- deps: path-to-regexp@0.1.3
- deps: send@0.6.0
  - deps: debug@1.0.3
- deps: serve-static1.3.2
  - deps: parseurl1.1.3
  - deps: send@0.6.0
- perf: fix arguments reassign deopt in some `res` methods

``

# 4.5.1 / 2014-07-06

``

``

- fix routing regression when altering `req.method`

``

# 4.5.0 / 2014-07-04

``

``

- add deprecation message to non-plural `req.accepts*`
- add deprecation message to `res.send(body, status)`
- add deprecation message to `res.vary()`
- add `headers` option to `res.sendfile`
  - use to set headers on successful file transfer
- add `mergeParams` option to `Router`
  - merges `req.params` from parent routes
- add `req.hostname` – correct name for what `req.host` returns
- deprecate things with `depd` module
- deprecate `req.host` – use `req.hostname` instead
- fix behavior when handling request without routes
- fix handling when `route.all` is only route
- invoke `router.param()` only when route matches
- restore `req.params` after invoking router
- use `finalhandler` for final response handling
- use `media-typer` to alter content-type charset
- deps: accepts1.0.7
- deps: send@0.5.0
  - Accept string for `maxage` (converted by `ms`)
  - Include link in default redirect response
- deps: serve-static1.3.0
  - Accept string for `maxAge` (converted by `ms`)
  - Add `setHeaders` option
  - Include HTML link in redirect response
  - deps: send@0.5.0
- deps: type-is1.3.2

``

# 4.4.5 / 2014-06-26

``

``

- deps: cookie-signature@1.0.4
  - fix for timing attacks

``

# 4.4.4 / 2014-06-20

``

``

- fix `res.attachment` Unicode filenames in Safari
- fix "trim prefix" debug message in `express:router`
- deps: accepts1.0.5
- deps: buffer-crc32@0.2.3

``

# 4.4.3 / 2014-06-11

``

``

- fix persistence of modified `req.params[name]` from `app.param()`
- deps: accepts@1.0.3
  - deps: negotiator@0.4.6
- deps: debug@1.0.2
- deps: send@0.4.3
  - Do not throw uncatchable error on file open race condition
  - Use `escape-html` for HTML escaping
  - deps: debug@1.0.2
  - deps: finished@1.2.2
  - deps: fresh@0.2.2
- deps: serve-static@1.2.3
  - Do not throw uncatchable error on file open race condition
  - deps: send@0.4.3

``

# 4.4.2 / 2014-06-09

``

``

- fix catching errors from top-level handlers
- use `vary` module for `res.vary`
- deps: debug@1.0.1
- deps: proxy-addr@1.0.1
- deps: send@0.4.2
  - fix "event emitter leak" warnings
  - deps: debug@1.0.1
  - deps: finished@1.2.1
- deps: serve-static@1.2.2
  - fix "event emitter leak" warnings
  - deps: send@0.4.2
- deps: type-is@1.2.1

``

# 4.4.1 / 2014-06-02

``

``

- deps: methods@1.0.1
- deps: send@0.4.1
  - Send `max-age` in `Cache-Control` in correct format
- deps: serve-static@1.2.1
  - use `escape-html` for escaping
  - deps: send@0.4.1

``

# 4.4.0 / 2014-05-30

``

``

- custom etag control with ‘app.set('etag’, val)`-`app.set('etag', function(body, encoding){ return '"etag"' })`custom etag generation -`app.set('etag', 'weak')`weak tag -`app.set('etag', 'strong')`strong etag -`app.set('etag', false)`turn off -`app.set('etag', true)`standard etag`
- `mark`res.send` ETag as weak and reduce collisions
- update accepts to 1.0.2
  - Fix interpretation when header not in request
- update send to 0.4.0
  - Calculate ETag with md5 for reduced collisions
  - Ignore stream errors after request ends
  - deps: debug@0.8.1
- update serve-static to 1.2.0
  - Calculate ETag with md5 for reduced collisions
  - Ignore stream errors after request ends
  - deps: send@0.4.0

``

# 4.3.2 / 2014-05-28

``

``

- fix handling of errors from `router.param()` callbacks

``

# 4.3.1 / 2014-05-23

``

``

- revert "fix behavior of multiple `app.VERB` for the same path"
  - this caused a regression in the order of route execution

``

# 4.3.0 / 2014-05-21

``

``

- add `req.baseUrl` to access the path stripped from `req.url` in routes
- fix behavior of multiple `app.VERB` for the same path
- fix issue routing requests among sub routers
- invoke `router.param()` only when necessary instead of every match
- proper proxy trust with ‘app.set('trust proxy’, trust)`-`app.set('trust proxy', 1)`trust first hop -`app.set('trust proxy', 'loopback')`trust loopback addresses -`app.set('trust proxy', '10.0.0.1')`trust single IP -`app.set('trust proxy', '10.0.0.1/16')`trust subnet -`app.set('trust proxy', '10.0.0.1, 10.0.0.2')`trust list -`app.set('trust proxy', false)`turn off -`app.set('trust proxy', true)`trust everything`
- `set proper`charset`in`Content-Type`for`res.send`
- update type-is to 1.2.0
  - support suffix matching

``

# 4.2.0 / 2014-05-11

``

``

- deprecate `app.del()` – use `app.delete()` instead
- deprecate `res.json(obj, status)` – use `res.json(status, obj)` instead
  - the edge-case `res.json(status, num)` requires `res.status(status).json(num)`
- deprecate `res.jsonp(obj, status)` – use `res.jsonp(status, obj)` instead
  - the edge-case `res.jsonp(status, num)` requires `res.status(status).jsonp(num)`
- fix `req.next` when inside router instance
- include `ETag` header in `HEAD` requests
- keep previous `Content-Type` for `res.jsonp`
- support PURGE method
  - add `app.purge`
  - add `router.purge`
  - include PURGE in `app.all`
- update debug to 0.8.0
  - add `enable()` method
  - change from stderr to stdout
- update methods to 1.0.0
  - add PURGE

``

# 4.1.2 / 2014-05-08

``

``

- fix `req.host` for IPv6 literals
- fix `res.jsonp` error if callback param is object

``

# 4.1.1 / 2014-04-27

``

``

- fix package.json to reflect supported node version

``

# 4.1.0 / 2014-04-24

``

``

- pass options from `res.sendfile` to `send`
- preserve casing of headers in `res.header` and `res.set`
- support unicode file names in `res.attachment` and `res.download`
- update accepts to 1.0.1
  - deps: negotiator@0.4.0
- update cookie to 0.1.2
  - Fix for maxAge == 0
  - made compat with expires field
- update send to 0.3.0
  - Accept API options in options object
  - Coerce option types
  - Control whether to generate etags
  - Default directory access to 403 when index disabled
  - Fix sending files with dots without root set
  - Include file path in etag
  - Make "Can't set headers after they are sent." catchable
  - Send full entity-body for multi range requests
  - Set etags to "weak"
  - Support "If-Range" header
  - Support multiple index paths
  - deps: mime@.nosp@m.1.2..nosp@m.11
- update serve-static to 1.1.0
  - Accept options directly to `send` module
  - Resolve relative paths at middleware setup
  - Use parseurl to parse the URL from request
  - deps: send@0.3.0
- update type-is to 1.1.0
  - add non-array values support
  - add `multipart` as a shorthand

``

# 4.0.0 / 2014-04-09

``

``

- remove:
  - node 0.8 support
  - connect and connect's patches except for charset handling
  - express(1) - moved to express-generator
  - `express.createServer()` - it has been deprecated for a long time. Use `express()`
  - `app.configure` - use logic in your own app code
  - `app.router` - is removed
  - `req.auth` - use `basic-auth` instead
  - `req.accepted*` - use `req.accepts*()` instead
  - `res.location` - relative URL resolution is removed
  - `res.charset` - include the charset in the content type when using `res.set()`
  - all bundled middleware except `static`
- change:
  - `app.route` -> `app.mountpath` when mounting an express app in another express app
  - `json spaces` no longer enabled by default in development
  - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
  - `req.params` is now an object instead of an array
  - `res.locals` is no longer a function. It is a plain js object. Treat it as such.
  - `res.headerSent` -> `res.headersSent` to match node.js ServerResponse object
- refactor:
  - `req.accepts*` with accepts
  - `req.is` with type-is
  - path-to-regexp
- add:
  - `app.router()` - returns the app Router instance
  - `app.route()` - Proxy to the app's `Router#route()` method to create a new route
  - Router & Route - public API

``

# 3.21.2 / 2015-07-31

``

``

- deps: conne.nosp@m.ct@2.nosp@m..30.2
  - deps: body-parser1.13.3
  - deps: compression1.5.2
  - deps: errorhandler1.4.2
  - deps: method-override2.3.5
  - deps: serve-index1.7.2
  - deps: type-is1.6.6
  - deps: vhost3.0.1
- deps: vary1.0.1
  - Fix setting empty header from empty `field`
  - perf: enable strict mode
  - perf: remove argument reassignments

``

# 3.21.1 / 2015-07-05

``

``

- deps: basic-auth1.0.3
- deps: conne.nosp@m.ct@2.nosp@m..30.1
  - deps: body-parser1.13.2
  - deps: compression1.5.1
  - deps: errorhandler1.4.1
  - deps: morgan1.6.1
  - deps: pause@0.1.0
  - deps: qs@4.0.0
  - deps: serve-index1.7.1
  - deps: type-is1.6.4

``

# 3.21.0 / 2015-06-18

``

``

- deps: basic-auth@1.0.2
  - perf: enable strict mode
  - perf: hoist regular expression
  - perf: parse with regular expressions
  - perf: remove argument reassignment
- deps: conne.nosp@m.ct@2.nosp@m..30.0
  - deps: body-parser1.13.1
  - deps: bytes@2.1.0
  - deps: compression1.5.0
  - deps: cookie@0.1.3
  - deps: cookie-parser1.3.5
  - deps: csurf1.8.3
  - deps: errorhandler1.4.0
  - deps: express-session1.11.3
  - deps: finalhandler@0.4.0
  - deps: fresh@0.3.0
  - deps: morgan1.6.0
  - deps: serve-favicon2.3.0
  - deps: serve-index1.7.0
  - deps: serve-static1.10.0
  - deps: type-is1.6.3
- deps: cookie@0.1.3
  - perf: deduce the scope of try-catch deopt
  - perf: remove argument reassignments
- deps: escape-html@1.0.2
- deps: etag1.7.0
  - Always include entity length in ETags for hash length extensions
  - Generate non-Stats ETags using MD5 only (no longer CRC32)
  - Improve stat performance by removing hashing
  - Improve support for JXcore
  - Remove base64 padding in ETags to shorten
  - Support "fake" stats objects in environments without fs
  - Use MD5 instead of MD4 in weak ETags over 1KB
- deps: fresh@0.3.0
  - Add weak `ETag` matching support
- deps: mkdirp@0.5.1
  - Work in global strict mode
- deps: send@.nosp@m.0.13.0
  - Allow Node.js HTTP server to set `Date` response header
  - Fix incorrectly removing `Content-Location` on 304 response
  - Improve the default redirect response headers
  - Send appropriate headers on default error response
  - Use `http-errors` for standard emitted errors
  - Use `statuses` instead of `http` module for status messages
  - deps: escape-html@1.0.2
  - deps: etag1.7.0
  - deps: fresh@0.3.0
  - deps: on-finished2.3.0
  - perf: enable strict mode
  - perf: remove unnecessary array allocations

``

# 3.20.3 / 2015-05-17

``

``

- deps: conne.nosp@m.ct@2.nosp@m..29.2
  - deps: body-parser1.12.4
  - deps: compression1.4.4
  - deps: connect-timeout1.6.2
  - deps: debug2.2.0
  - deps: depd1.0.1
  - deps: errorhandler1.3.6
  - deps: finalhandler@0.3.6
  - deps: method-override2.3.3
  - deps: morgan1.5.3
  - deps: qs@2.4.2
  - deps: response-time2.3.1
  - deps: serve-favicon2.2.1
  - deps: serve-index1.6.4
  - deps: serve-static1.9.3
  - deps: type-is1.6.2
- deps: debug2.2.0
  - deps: ms@0.7.1
- deps: depd1.0.1
- deps: proxy-addr1.0.8
  - deps: ipaddr.js@1.0.1
- deps: send@.nosp@m.0.12.3
  - deps: debug2.2.0
  - deps: depd1.0.1
  - deps: etag1.6.0
  - deps: ms@0.7.1
  - deps: on-finished2.2.1

``

# 3.20.2 / 2015-03-16

``

``

- deps: conne.nosp@m.ct@2.nosp@m..29.1
  - deps: body-parser1.12.2
  - deps: compression1.4.3
  - deps: connect-timeout1.6.1
  - deps: debug2.1.3
  - deps: errorhandler1.3.5
  - deps: express-session1.10.4
  - deps: finalhandler@0.3.4
  - deps: method-override2.3.2
  - deps: morgan1.5.2
  - deps: qs@2.4.1
  - deps: serve-index1.6.3
  - deps: serve-static1.9.2
  - deps: type-is1.6.1
- deps: debug2.1.3
  - Fix high intensity foreground color for bold
  - deps: ms@0.7.0
- deps: merge-descriptors@1.0.0
- deps: proxy-addr1.0.7
  - deps: ipaddr.js@0.1.9
- deps: send@.nosp@m.0.12.2
  - Throw errors early for invalid `extensions` or `index` options
  - deps: debug2.1.3

``

# 3.20.1 / 2015-02-28

``

``

- Fix `req.host` when using "trust proxy" hops count
- Fix `req.protocol`/`req.secure` when using "trust proxy" hops count

``

# 3.20.0 / 2015-02-18

``

``

- Fix `"trust proxy"` setting to inherit when app is mounted
- Generate `ETag`s for all request responses
  - No longer restricted to only responses for `GET` and `HEAD` requests
- Use `content-type` to parse `Content-Type` headers
- deps: conne.nosp@m.ct@2.nosp@m..29.0
  - Use `content-type` to parse `Content-Type` headers
  - deps: body-parser1.12.0
  - deps: compression1.4.1
  - deps: connect-timeout1.6.0
  - deps: cookie-parser1.3.4
  - deps: cookie-signature@1.0.6
  - deps: csurf1.7.0
  - deps: errorhandler1.3.4
  - deps: express-session1.10.3
  - deps: http-errors1.3.1
  - deps: response-time2.3.0
  - deps: serve-index1.6.2
  - deps: serve-static1.9.1
  - deps: type-is1.6.0
- deps: cookie-signature@1.0.6
- deps: send@.nosp@m.0.12.1
  - Always read the stat size from the file
  - Fix mutating passed-in `options`
  - deps: mime@1.3.4

``

# 3.19.2 / 2015-02-01

``

``

- deps: conne.nosp@m.ct@2.nosp@m..28.3
  - deps: compression1.3.1
  - deps: csurf1.6.6
  - deps: errorhandler1.3.3
  - deps: express-session1.10.2
  - deps: serve-index1.6.1
  - deps: type-is1.5.6
- deps: proxy-addr1.0.6
  - deps: ipaddr.js@0.1.8

``

# 3.19.1 / 2015-01-20

``

``

- deps: conne.nosp@m.ct@2.nosp@m..28.2
  - deps: body-parser1.10.2
  - deps: serve-static1.8.1
- deps: send@.nosp@m.0.11.1
  - Fix root path disclosure

``

# 3.19.0 / 2015-01-09

``

``

- Fix `OPTIONS` responses to include the `HEAD` method property
- Use `readline` for prompt in `express(1)`
- deps: commander@2.6.0
- deps: conne.nosp@m.ct@2.nosp@m..28.1
  - deps: body-parser1.10.1
  - deps: compression1.3.0
  - deps: connect-timeout1.5.0
  - deps: csurf1.6.4
  - deps: debug2.1.1
  - deps: errorhandler1.3.2
  - deps: express-session1.10.1
  - deps: finalhandler@0.3.3
  - deps: method-override2.3.1
  - deps: morgan1.5.1
  - deps: serve-favicon2.2.0
  - deps: serve-index1.6.0
  - deps: serve-static1.8.0
  - deps: type-is1.5.5
- deps: debug2.1.1
- deps: methods1.1.1
- deps: proxy-addr1.0.5
  - deps: ipaddr.js@0.1.6
- deps: send@.nosp@m.0.11.0
  - deps: debug2.1.1
  - deps: etag1.5.1
  - deps: ms@0.7.0
  - deps: on-finished2.2.0

``

# 3.18.6 / 2014-12-12

``

``

- Fix exception in `req.fresh`/`req.stale` without response headers

``

# 3.18.5 / 2014-12-11

``

``

- deps: conne.nosp@m.ct@2.nosp@m..27.6
  - deps: compression1.2.2
  - deps: express-session1.9.3
  - deps: http-errors1.2.8
  - deps: serve-index1.5.3
  - deps: type-is1.5.4

``

# 3.18.4 / 2014-11-23

``

``

- deps: conne.nosp@m.ct@2.nosp@m..27.4
  - deps: body-parser1.9.3
  - deps: compression1.2.1
  - deps: errorhandler1.2.3
  - deps: express-session1.9.2
  - deps: qs@2.3.3
  - deps: serve-favicon2.1.7
  - deps: serve-static1.5.1
  - deps: type-is1.5.3
- deps: etag1.5.1
- deps: proxy-addr1.0.4
  - deps: ipaddr.js@0.1.5

``

# 3.18.3 / 2014-11-09

``

``

- deps: conne.nosp@m.ct@2.nosp@m..27.3
  - Correctly invoke async callback asynchronously
  - deps: csurf1.6.3

``

# 3.18.2 / 2014-10-28

``

``

- deps: conne.nosp@m.ct@2.nosp@m..27.2
  - Fix handling of URLs containing `://` in the path
  - deps: body-parser1.9.2
  - deps: qs@2.3.2

``

# 3.18.1 / 2014-10-22

``

``

- Fix internal `utils.merge` deprecation warnings
- deps: conne.nosp@m.ct@2.nosp@m..27.1
  - deps: body-parser1.9.1
  - deps: express-session1.9.1
  - deps: finalhandler@0.3.2
  - deps: morgan1.4.1
  - deps: qs@2.3.0
  - deps: serve-static1.7.1
- deps: send@.nosp@m.0.10.1
  - deps: on-finished2.1.1

``

# 3.18.0 / 2014-10-17

``

``

- Use `content-disposition` module for `res.attachment`/`res.download`
  - Sends standards-compliant `Content-Disposition` header
  - Full Unicode support
- Use `etag` module to generate `ETag` headers
- deps: conne.nosp@m.ct@2.nosp@m..27.0
  - Use `http-errors` module for creating errors
  - Use `utils-merge` module for merging objects
  - deps: body-parser1.9.0
  - deps: compression1.2.0
  - deps: connect-timeout1.4.0
  - deps: debug2.1.0
  - deps: depd1.0.0
  - deps: express-session1.9.0
  - deps: finalhandler@0.3.1
  - deps: method-override2.3.0
  - deps: morgan1.4.0
  - deps: response-time2.2.0
  - deps: serve-favicon2.1.6
  - deps: serve-index1.5.0
  - deps: serve-static1.7.0
- deps: debug2.1.0
  - Implement `DEBUG_FD` env variable support
- deps: depd1.0.0
- deps: send@.nosp@m.0.10.0
  - deps: debug2.1.0
  - deps: depd1.0.0
  - deps: etag1.5.0

``

# 3.17.8 / 2014-10-15

``

``

- deps: conne.nosp@m.ct@2.nosp@m..26.6
  - deps: compression1.1.2
  - deps: csurf1.6.2
  - deps: errorhandler1.2.2

``

# 3.17.7 / 2014-10-08

``

``

- deps: conne.nosp@m.ct@2.nosp@m..26.5
  - Fix accepting non-object arguments to `logger`
  - deps: serve-static1.6.4

``

# 3.17.6 / 2014-10-02

``

``

- deps: conne.nosp@m.ct@2.nosp@m..26.4
  - deps: morgan1.3.2
  - deps: type-is1.5.2

``

# 3.17.5 / 2014-09-24

``

``

- deps: conne.nosp@m.ct@2.nosp@m..26.3
  - deps: body-parser1.8.4
  - deps: serve-favicon2.1.5
  - deps: serve-static1.6.3
- deps: proxy-addr1.0.3
  - Use `forwarded` npm module
- deps: send@0.9.3
  - deps: etag1.4.0

``

# 3.17.4 / 2014-09-19

``

``

- deps: conne.nosp@m.ct@2.nosp@m..26.2
  - deps: body-parser1.8.3
  - deps: qs@2.2.4

``

# 3.17.3 / 2014-09-18

``

``

- deps: proxy-addr1.0.2
  - Fix a global leak when multiple subnets are trusted
  - deps: ipaddr.js@0.1.3

``

# 3.17.2 / 2014-09-15

``

``

- Use `crc` instead of `buffer-crc32` for speed
- deps: conne.nosp@m.ct@2.nosp@m..26.1
  - deps: body-parser1.8.2
  - deps: depd@0.4.5
  - deps: express-session1.8.2
  - deps: morgan1.3.1
  - deps: serve-favicon2.1.3
  - deps: serve-static1.6.2
- deps: depd@0.4.5
- deps: send@0.9.2
  - deps: depd@0.4.5
  - deps: etag1.3.1
  - deps: range-parser1.0.2

``

# 3.17.1 / 2014-09-08

``

``

- Fix error in `req.subdomains` on empty host

``

# 3.17.0 / 2014-09-08

``

``

- Support `X-Forwarded-Host` in `req.subdomains`
- Support IP address host in `req.subdomains`
- deps: conne.nosp@m.ct@2.nosp@m..26.0
  - deps: body-parser1.8.1
  - deps: compression1.1.0
  - deps: connect-timeout1.3.0
  - deps: cookie-parser1.3.3
  - deps: cookie-signature@1.0.5
  - deps: csurf1.6.1
  - deps: debug2.0.0
  - deps: errorhandler1.2.0
  - deps: express-session1.8.1
  - deps: finalhandler@0.2.0
  - deps: fresh@0.2.4
  - deps: media-typer@0.3.0
  - deps: method-override2.2.0
  - deps: morgan1.3.0
  - deps: qs@2.2.3
  - deps: serve-favicon2.1.3
  - deps: serve-index1.2.1
  - deps: serve-static1.6.1
  - deps: type-is1.5.1
  - deps: vhost3.0.0
- deps: cookie-signature@1.0.5
- deps: debug2.0.0
- deps: fresh@0.2.4
- deps: media-typer@0.3.0
  - Throw error when parameter format invalid on parse
- deps: range-parser1.0.2
- deps: send@0.9.1
  - Add `lastModified` option
  - Use `etag` to generate `ETag` header
  - deps: debug2.0.0
  - deps: fresh@0.2.4
- deps: vary1.0.0
  - Accept valid `Vary` header string as `field`

``

# 3.16.10 / 2014-09-04

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.1.nosp@m.0
  - deps: serve-static1.5.4
- deps: send@0.8.5
  - Fix a path traversal issue when using `root`
  - Fix malicious path detection for empty string path

``

# 3.16.9 / 2014-08-29

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.9
  - deps: body-parser1.6.7
  - deps: qs@2.2.2

``

# 3.16.8 / 2014-08-27

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.8
  - deps: body-parser1.6.6
  - deps: csurf1.4.1
  - deps: qs@2.2.0

``

# 3.16.7 / 2014-08-18

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.7
  - deps: body-parser1.6.5
  - deps: express-session1.7.6
  - deps: morgan1.2.3
  - deps: serve-static1.5.3
- deps: send@0.8.3
  - deps: destroy@1.0.3
  - deps: on-finished@2.1.0

``

# 3.16.6 / 2014-08-14

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.6
  - deps: body-parser1.6.4
  - deps: qs@1.2.2
  - deps: serve-static1.5.2
- deps: send@0.8.2
  - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`

``

# 3.16.5 / 2014-08-11

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.5
  - Fix backwards compatibility in `logger`

``

# 3.16.4 / 2014-08-10

``

``

- Fix original URL parsing in `res.location`
- deps: conne.nosp@m.ct@2.nosp@m..25.4
  - Fix `query` middleware breaking with argument
  - deps: body-parser1.6.3
  - deps: compression1.0.11
  - deps: connect-timeout1.2.2
  - deps: express-session1.7.5
  - deps: method-override2.1.3
  - deps: on-headers1.0.0
  - deps: parseurl1.3.0
  - deps: qs@1.2.1
  - deps: response-time2.0.1
  - deps: serve-index1.1.6
  - deps: serve-static1.5.1
- deps: parseurl1.3.0

``

# 3.16.3 / 2014-08-07

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.3
  - deps: multiparty@3.3.2

``

# 3.16.2 / 2014-08-07

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.2
  - deps: body-parser1.6.2
  - deps: qs@1.2.0

``

# 3.16.1 / 2014-08-06

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.1
  - deps: body-parser1.6.1
  - deps: qs@1.1.0

``

# 3.16.0 / 2014-08-05

``

``

- deps: conne.nosp@m.ct@2.nosp@m..25.0
  - deps: body-parser1.6.0
  - deps: compression1.0.10
  - deps: csurf1.4.0
  - deps: express-session1.7.4
  - deps: qs@1.0.2
  - deps: serve-static1.5.0
- deps: send@0.8.1
  - Add `extensions` option

``

# 3.15.3 / 2014-08-04

``

``

- fix `res.sendfile` regression for serving directory index files
- deps: conne.nosp@m.ct@2.nosp@m..24.3
  - deps: serve-index1.1.5
  - deps: serve-static1.4.4
- deps: send@0.7.4
  - Fix incorrect 403 on Windows and Node.js 0.11
  - Fix serving index files without root dir

``

# 3.15.2 / 2014-07-27

``

``

- deps: conne.nosp@m.ct@2.nosp@m..24.2
  - deps: body-parser1.5.2
  - deps: depd@0.4.4
  - deps: express-session1.7.2
  - deps: morgan1.2.2
  - deps: serve-static1.4.2
- deps: depd@0.4.4
  - Work-around v8 generating empty stack traces
- deps: send@0.7.2
  - deps: depd@0.4.4

``

# 3.15.1 / 2014-07-26

``

``

- deps: conne.nosp@m.ct@2.nosp@m..24.1
  - deps: body-parser1.5.1
  - deps: depd@0.4.3
  - deps: express-session1.7.1
  - deps: morgan1.2.1
  - deps: serve-index1.1.4
  - deps: serve-static1.4.1
- deps: depd@0.4.3
  - Fix exception when global `Error.stackTraceLimit` is too low
- deps: send@0.7.1
  - deps: depd@0.4.3

``

# 3.15.0 / 2014-07-22

``

``

- Fix `req.protocol` for proxy-direct connections
- Pass options from `res.sendfile` to `send`
- deps: conne.nosp@m.ct@2.nosp@m..24.0
  - deps: body-parser1.5.0
  - deps: compression1.0.9
  - deps: connect-timeout1.2.1
  - deps: debug@1.0.4
  - deps: depd@0.4.2
  - deps: express-session1.7.0
  - deps: finalhandler@0.1.0
  - deps: method-override2.1.2
  - deps: morgan1.2.0
  - deps: multiparty@3.3.1
  - deps: parseurl1.2.0
  - deps: serve-static1.4.0
- deps: debug@1.0.4
- deps: depd@0.4.2
  - Add `TRACE_DEPRECATION` environment variable
  - Remove non-standard grey color from color output
  - Support `--no-deprecation` argument
  - Support `--trace-deprecation` argument
- deps: parseurl1.2.0
  - Cache URLs based on original value
  - Remove no-longer-needed URL mis-parse work-around
  - Simplify the "fast-path" `RegExp`
- deps: send@0.7.0
  - Add `dotfiles` option
  - Cap `maxAge` value to 1 year
  - deps: debug@1.0.4
  - deps: depd@0.4.2

``

# 3.14.0 / 2014-07-11

``

``

- add explicit "Rosetta Flash JSONP abuse" protection
  - previous versions are not vulnerable; this is just explicit protection
- deprecate `res.redirect(url, status)` – use `res.redirect(status, url)` instead
- fix `res.send(status, num)` to send `num` as json (not error)
- remove unnecessary escaping when `res.jsonp` returns JSON response
- deps: basic-auth@1.0.0
  - support empty password
  - support empty username
- deps: conne.nosp@m.ct@2.nosp@m..23.0
  - deps: debug@1.0.3
  - deps: express-session1.6.4
  - deps: method-override2.1.0
  - deps: parseurl1.1.3
  - deps: serve-static1.3.1

`deps: debug@1.0.3`

- Add support for multiple wildcards in namespaces

`deps: methods@1.1.0`

- add `CONNECT`

`deps: parseurl1.1.3`

- faster parsing of href-only URLs

``

# 3.13.0 / 2014-07-03

``

``

- add deprecation message to `app.configure`
- add deprecation message to `req.auth`
- use `basic-auth` to parse `Authorization` header
- deps: conne.nosp@m.ct@2.nosp@m..22.0
  - deps: csurf1.3.0
  - deps: express-session1.6.1
  - deps: multiparty@3.3.0
  - deps: serve-static1.3.0
- deps: send@0.5.0
  - Accept string for `maxage` (converted by `ms`)
  - Include link in default redirect response

``

# 3.12.1 / 2014-06-26

``

``

- deps: conne.nosp@m.ct@2.nosp@m..21.1
  - deps: cookie-parser@1.3.2
  - deps: cookie-signature@1.0.4
  - deps: express-session1.5.2
  - deps: type-is1.3.2
- deps: cookie-signature@1.0.4
  - fix for timing attacks

``

# 3.12.0 / 2014-06-21

``

``

- use `media-typer` to alter content-type charset
- deps: conne.nosp@m.ct@2.nosp@m..21.0
  - deprecate `connect(middleware)` – use `app.use(middleware)` instead
  - deprecate `connect.createServer()` – use `connect()` instead
  - fix `res.setHeader()` patch to work with with get -> append -> set pattern
  - deps: compression1.0.8
  - deps: errorhandler1.1.1
  - deps: express-session1.5.0
  - deps: serve-index1.1.3

``

# 3.11.0 / 2014-06-19

``

``

- deprecate things with `depd` module
- deps: buffer-crc32@0.2.3
- deps: conne.nosp@m.ct@2.nosp@m..20.2
  - deprecate `verify` option to `json` – use `body-parser` npm module instead
  - deprecate `verify` option to `urlencoded` – use `body-parser` npm module instead
  - deprecate things with `depd` module
  - use `finalhandler` for final response handling
  - use `media-typer` to parse `content-type` for charset
  - deps: body-parser@1.4.3
  - deps: connect-timeout@1.1.1
  - deps: cookie-parser@1.3.1
  - deps: csurf@1.2.2
  - deps: errorhandler@1.1.0
  - deps: express-session@1.4.0
  - deps: multiparty@3.2.9
  - deps: serve-index@1.1.2
  - deps: type-is@1.3.1
  - deps: vhost@2.0.0

``

# 3.10.5 / 2014-06-11

``

``

- deps: conne.nosp@m.ct@2.nosp@m..19.6
  - deps: body-parser@1.3.1
  - deps: compression@1.0.7
  - deps: debug@1.0.2
  - deps: serve-index@1.1.1
  - deps: serve-static@1.2.3
- deps: debug@1.0.2
- deps: send@0.4.3
  - Do not throw uncatchable error on file open race condition
  - Use `escape-html` for HTML escaping
  - deps: debug@1.0.2
  - deps: finished@1.2.2
  - deps: fresh@0.2.2

``

# 3.10.4 / 2014-06-09

``

``

- deps: conne.nosp@m.ct@2.nosp@m..19.5
  - fix "event emitter leak" warnings
  - deps: csurf@1.2.1
  - deps: debug@1.0.1
  - deps: serve-static@1.2.2
  - deps: type-is@1.2.1
- deps: debug@1.0.1
- deps: send@0.4.2
  - fix "event emitter leak" warnings
  - deps: finished@1.2.1
  - deps: debug@1.0.1

``

# 3.10.3 / 2014-06-05

``

``

- use `vary` module for `res.vary`
- deps: conne.nosp@m.ct@2.nosp@m..19.4
  - deps: errorhandler@1.0.2
  - deps: method-override@2.0.2
  - deps: serve-favicon@2.0.1
- deps: debug@1.0.0

``

# 3.10.2 / 2014-06-03

``

``

- deps: conne.nosp@m.ct@2.nosp@m..19.3
  - deps: compression@1.0.6

``

# 3.10.1 / 2014-06-03

``

``

- deps: conne.nosp@m.ct@2.nosp@m..19.2
  - deps: compression@1.0.4
- deps: proxy-addr@1.0.1

``

# 3.10.0 / 2014-06-02

``

``

- deps: conne.nosp@m.ct@2.nosp@m..19.1
  - deprecate `methodOverride()` – use `method-override` npm module instead
  - deps: body-parser@1.3.0
  - deps: method-override@2.0.1
  - deps: multiparty@3.2.8
  - deps: response-time@2.0.0
  - deps: serve-static@1.2.1
- deps: methods@1.0.1
- deps: send@0.4.1
  - Send `max-age` in `Cache-Control` in correct format

``

# 3.9.0 / 2014-05-30

``

``

- custom etag control with ‘app.set('etag’, val)`-`app.set('etag', function(body, encoding){ return '"etag"' })`custom etag generation -`app.set('etag', 'weak')`weak tag -`app.set('etag', 'strong')`strong etag -`app.set('etag', false)`turn off -`app.set('etag', true)` standard etag
- Include ETag in HEAD requests
- mark `res.send` ETag as weak and reduce collisions
- update connect to 2.18.0
  - deps: compression@1.0.3
  - deps: serve-index@1.1.0
  - deps: serve-static@1.2.0
- update send to 0.4.0
  - Calculate ETag with md5 for reduced collisions
  - Ignore stream errors after request ends
  - deps: debug@0.8.1

``

# 3.8.1 / 2014-05-27

``

``

- update connect to 2.17.3
  - deps: body-parser@1.2.2
  - deps: express-session@1.2.1
  - deps: method-override@1.0.2

``

# 3.8.0 / 2014-05-21

``

``

- keep previous `Content-Type` for `res.jsonp`
- set proper `charset` in `Content-Type` for `res.send`
- update connect to 2.17.1
  - fix `res.charset` appending charset when `content-type` has one
  - deps: express-session@1.2.0
  - deps: morgan@1.1.1
  - deps: serve-index@1.0.3

``

# 3.7.0 / 2014-05-18

``

``

- proper proxy trust with ‘app.set('trust proxy’, trust)`-`app.set('trust proxy', 1)`trust first hop -`app.set('trust proxy', 'loopback')`trust loopback addresses -`app.set('trust proxy', '10.0.0.1')`trust single IP -`app.set('trust proxy', '10.0.0.1/16')`trust subnet -`app.set('trust proxy', '10.0.0.1, 10.0.0.2')`trust list -`app.set('trust proxy', false)`turn off -`app.set('trust proxy', true)` trust everything
- update connect to 2.16.2
  - deprecate `res.headerSent` – use `res.headersSent`
  - deprecate `res.on("header")` – use on-headers module instead
  - fix edge-case in `res.appendHeader` that would append in wrong order
  - json: use body-parser
  - urlencoded: use body-parser
  - dep: bytes@1.0.0
  - dep: cookie-parser@1.1.0
  - dep: csurf@1.2.0
  - dep: express-session@1.1.0
  - dep: method-override@1.0.1

``

# 3.6.0 / 2014-05-09

``

``

- deprecate `app.del()` – use `app.delete()` instead
- deprecate `res.json(obj, status)` – use `res.json(status, obj)` instead
  - the edge-case `res.json(status, num)` requires `res.status(status).json(num)`
- deprecate `res.jsonp(obj, status)` – use `res.jsonp(status, obj)` instead
  - the edge-case `res.jsonp(status, num)` requires `res.status(status).jsonp(num)`
- support PURGE method
  - add `app.purge`
  - add `router.purge`
  - include PURGE in `app.all`
- update connect to 2.15.0
  - Add `res.appendHeader`
  - Call error stack even when response has been sent
  - Patch `res.headerSent` to return Boolean
  - Patch `res.headersSent` for node.js 0.8
  - Prevent default 404 handler after response sent
  - dep: compression@1.0.2
  - dep: connect-timeout@1.1.0
  - dep: debug@^0.8.0
  - dep: errorhandler@1.0.1
  - dep: express-session@1.0.4
  - dep: morgan@1.0.1
  - dep: serve-favicon@2.0.0
  - dep: serve-index@1.0.2
- update debug to 0.8.0
  - add `enable()` method
  - change from stderr to stdout
- update methods to 1.0.0
  - add PURGE
- update mkdirp to 0.5.0

``

# 3.5.3 / 2014-05-08

``

``

- fix `req.host` for IPv6 literals
- fix `res.jsonp` error if callback param is object

``

# 3.5.2 / 2014-04-24

``

``

- update connect to 2.14.5
- update cookie to 0.1.2
- update mkdirp to 0.4.0
- update send to 0.3.0

``

# 3.5.1 / 2014-03-25

``

``

- pin less-middleware in generated app

``

# 3.5.0 / 2014-03-06

``

``

- bump deps

``

# 3.4.8 / 2014-01-13

``

``

- prevent incorrect automatic OPTIONS responses #1868 @dpatti
- update binary and examples for jade 1.0 #1876 @yossi, #1877 @reqshark, #1892 @matheusazzi
- throw 400 in case of malformed paths @rlidwka

``

# 3.4.7 / 2013-12-10

``

``

- update connect

``

# 3.4.6 / 2013-12-01

``

``

- update connect (raw-body)

``

# 3.4.5 / 2013-11-27

``

``

- update connect
- res.location: remove leading ./ #1802 @kapouer
- res.redirect: fix ‘res.redirect('toString’) #1829 @michaelficarra
- res.send: always send ETag when content-length > 0
- router: add Router.all() method

``

# 3.4.4 / 2013-10-29

``

``

- update connect
- update supertest
- update methods
- express(1): replace bodyParser() with urlencoded() and json() #1795 @chirag04

``

# 3.4.3 / 2013-10-23

``

``

- update connect

``

# 3.4.2 / 2013-10-18

``

``

- update connect
- downgrade commander

``

# 3.4.1 / 2013-10-15

``

``

- update connect
- update commander
- jsonp: check if callback is a function
- router: wrap encodeURIComponent in a try/catch #1735 (@lxe)
- res.format: now includes charset @1747 (@sorribas)
- res.links: allow multiple calls @1746 (@sorribas)

``

# 3.4.0 / 2013-09-07

``

``

- add res.vary(). Closes #1682
- update connect

``

# 3.3.8 / 2013-09-02

``

``

- update connect

``

# 3.3.7 / 2013-08-28

``

``

- update connect

``

# 3.3.6 / 2013-08-27

``

``

- Revert "remove charset from json responses. Closes #1631" (causes issues in some clients)
- add: req.accepts take an argument list

``

# 3.3.4 / 2013-07-08

``

``

- update send and connect

``

# 3.3.3 / 2013-07-04

``

``

- update connect

``

# 3.3.2 / 2013-07-03

``

``

- update connect
- update send
- remove .version export

``

# 3.3.1 / 2013-06-27

``

``

- update connect

``

# 3.3.0 / 2013-06-26

``

``

- update connect
- add support for multiple X-Forwarded-Proto values. Closes #1646
- change: remove charset from json responses. Closes #1631
- change: return actual booleans from req.accept* functions
- fix jsonp callback array throw

``

# 3.2.6 / 2013-06-02

``

``

- update connect

``

# 3.2.5 / 2013-05-21

``

``

- update connect
- update node-cookie
- add: throw a meaningful error when there is no default engine
- change generation of ETags with res.send() to GET requests only. Closes #1619

``

# 3.2.4 / 2013-05-09

``

``

- fix `req.subdomains` when no Host is present
- fix `req.host` when no Host is present, return undefined

``

# 3.2.3 / 2013-05-07

``

``

- update connect / qs

``

# 3.2.2 / 2013-05-03

``

``

- update qs

``

# 3.2.1 / 2013-04-29

``

``

- add app.VERB() paths array deprecation warning
- update connect
- update qs and remove all ~ semver crap
- fix: accept number as value of Signed Cookie

``

# 3.2.0 / 2013-04-15

``

``

- add "view" constructor setting to override view behaviour
- add req.acceptsEncoding(name)
- add req.acceptedEncodings
- revert cookie signature change causing session race conditions
- fix sorting of Accept values of the same quality

``

# 3.1.2 / 2013-04-12

``

``

- add support for custom Accept parameters
- update cookie-signature

``

# 3.1.1 / 2013-04-01

``

``

- add X-Forwarded-Host support to `req.host`
- fix relative redirects
- update mkdirp
- update buffer-crc32
- remove legacy app.configure() method from app template.

``

# 3.1.0 / 2013-01-25

``

``

- add support for leading "." in "view engine" setting
- add array support to `res.set()`
- add node 0.8.x to travis.yml
- add "subdomain offset" setting for tweaking `req.subdomains`
- add `res.location(url)` implementing `res.redirect()`-like setting of Location
- use app.get() for x-powered-by setting for inheritance
- fix colons in passwords for `req.auth`

``

# 3.0.6 / 2013-01-04

``

``

- add http verb methods to Router
- update connect
- fix mangling of the `res.cookie()` options object
- fix jsonp whitespace escape. Closes #1132

``

# 3.0.5 / 2012-12-19

``

``

- add throwing when a non-function is passed to a route
- fix: explicitly remove Transfer-Encoding header from 204 and 304 responses
- revert "add 'etag' option"

``

# 3.0.4 / 2012-12-05

``

``

- add 'etag' option to disable `res.send()` Etags
- add escaping of urls in text/plain in `res.redirect()` for old browsers interpreting as html
- change crc32 module for a more liberal license
- update connect

``

# 3.0.3 / 2012-11-13

``

``

- update connect
- update cookie module
- fix cookie max-age

``

# 3.0.2 / 2012-11-08

``

``

- add OPTIONS to cors example. Closes #1398
- fix route chaining regression. Closes #1397

``

# 3.0.1 / 2012-11-01

``

``

- update connect

``

# 3.0.0 / 2012-10-23

``

``

- add `make clean`
- add "Basic" check to req.auth
- add `req.auth` test coverage
- add cb && cb(payload) to `res.jsonp()`. Closes #1374
- add backwards compat for `res.redirect()` status. Closes #1336
- add support for `res.json()` to retain previously defined Content-Types. Closes #1349
- update connect
- change `res.redirect()` to utilize a pathname-relative Location again. Closes #1382
- remove non-primitive string support for `res.send()`
- fix view-locals example. Closes #1370
- fix route-separation example

``

# 3.0.0rc5 / 2012-09-18

``

``

- update connect
- add redis search example
- add static-files example
- add "x-powered-by" setting (‘app.disable('x-powered-by’)`)
- add "application/octet-stream" redirect Accept test case. Closes #1317

``

# 3.0.0rc4 / 2012-08-30

``

``

- add `res.jsonp()`. Closes #1307
- add "verbose errors" option to error-pages example
- add another route example to express(1) so people are not so confused
- add redis online user activity tracking example
- update connect dep
- fix etag quoting. Closes #1310
- fix error-pages 404 status
- fix jsonp callback char restrictions
- remove old OPTIONS default response

``

# 3.0.0rc3 / 2012-08-13

``

``

- update connect dep
- fix signed cookies to work with `connect.cookieParser()` ("s:" prefix was missing) [tnydwrds]
- fix `res.render()` clobbering of "locals"

``

# 3.0.0rc2 / 2012-08-03

``

``

- add CORS example
- update connect dep
- deprecate `.createServer()` & remove old stale examples
- fix: escape `res.redirect()` link
- fix vhost example

``

# 3.0.0rc1 / 2012-07-24

``

``

- add more examples to view-locals
- add scheme-relative redirects (`res.redirect("//foo.com")`) support
- update cookie dep
- update connect dep
- update send dep
- fix `express(1)` -h flag, use -H for hogan. Closes #1245
- fix `res.sendfile()` socket error handling regression

``

# 3.0.0beta7 / 2012-07-16

``

``

- update connect dep for `send()` root normalization regression

``

# 3.0.0beta6 / 2012-07-13

``

``

- add `err.view` property for view errors. Closes #1226
- add "jsonp callback name" setting
- add support for "/foo/:bar*" non-greedy matches
- change `res.sendfile()` to use `send()` module
- change `res.send` to use "response-send" module
- remove `app.locals.use` and `res.locals.use`, use regular middleware

``

# 3.0.0beta5 / 2012-07-03

``

``

- add "make check" support
- add route-map example
- add `res.json(obj, status)` support back for BC
- add "methods" dep, remove internal methods module
- update connect dep
- update auth example to utilize cores pbkdf2
- updated tests to use "supertest"

``

# 3.0.0beta4 / 2012-06-25

``

``

- Added `req.auth`
- Added `req.range(size)`
- Added `res.links(obj)`
- Added `res.send(body, status)` support back for backwards compat
- Added `.default()` support to `res.format()`
- Added 2xx / 304 check to `req.fresh`
- Revert "Added + support to the router"
- Fixed `res.send()` freshness check, respect res.statusCode

``

# 3.0.0beta3 / 2012-06-15

``

``

- Added hogan `--hjs` to express(1) [nullfirm]
- Added another example to content-negotiation
- Added `fresh` dep
- Changed: `res.send()` always checks freshness
- Fixed: expose connects mime module. Closes #1165

``

# 3.0.0beta2 / 2012-06-06

``

``

- Added `+` support to the router
- Added `req.host`
- Changed `req.param()` to check route first
- Update connect dep

``

# 3.0.0beta1 / 2012-06-01

``

``

- Added `res.format()` callback to override default 406 behaviour
- Fixed `res.redirect()` 406. Closes #1154

``

# 3.0.0alpha5 / 2012-05-30

``

``

- Added `req.ip`
- Added `{ signed: true }` option to `res.cookie()`
- Removed `res.signedCookie()`
- Changed: dont reverse `req.ips`
- Fixed "trust proxy" setting check for `req.ips`

``

# 3.0.0alpha4 / 2012-05-09

``

``

- Added: allow `[]` in jsonp callback. Closes #1128
- Added `PORT` env var support in generated template. Closes #1118 [benatkin]
- Updated: connect 2.2.2

``

# 3.0.0alpha3 / 2012-05-04

``

``

- Added public `app.routes`. Closes #887
- Added view-locals example
- Added mvc example
- Added `res.locals.use()`. Closes #1120
- Added conditional-GET support to `res.send()`
- Added: coerce `res.set()` values to strings
- Changed: moved `static()` in generated apps below router
- Changed: `res.send()` only set ETag when not previously set
- Changed connect 2.2.1 dep
- Changed: `make test` now runs unit / acceptance tests
- Fixed req/res proto inheritance

``

# 3.0.0alpha2 / 2012-04-26

``

``

- Added `make benchmark` back
- Added `res.send()` support for `String` objects
- Added client-side data exposing example
- Added `res.header()` and `req.header()` aliases for BC
- Added `express.createServer()` for BC
- Perf: memoize parsed urls
- Perf: connect 2.2.0 dep
- Changed: make `expressInit()` middleware self-aware
- Fixed: use app.get() for all core settings
- Fixed redis session example
- Fixed session example. Closes #1105
- Fixed generated express dep. Closes #1078

``

# 3.0.0alpha1 / 2012-04-15

``

``

- Added `app.locals.use(callback)`
- Added `app.locals` object
- Added `app.locals(obj)`
- Added `res.locals` object
- Added `res.locals(obj)`
- Added `res.format()` for content-negotiation
- Added `app.engine()`
- Added `res.cookie()` JSON cookie support
- Added "trust proxy" setting
- Added `req.subdomains`
- Added `req.protocol`
- Added `req.secure`
- Added `req.path`
- Added `req.ips`
- Added `req.fresh`
- Added `req.stale`
- Added comma-delimited / array support for `req.accepts()`
- Added debug instrumentation
- Added `res.set(obj)`
- Added `res.set(field, value)`
- Added `res.get(field)`
- Added `app.get(setting)`. Closes #842
- Added `req.acceptsLanguage()`
- Added `req.acceptsCharset()`
- Added `req.accepted`
- Added `req.acceptedLanguages`
- Added `req.acceptedCharsets`
- Added "json replacer" setting
- Added "json spaces" setting
- Added X-Forwarded-Proto support to `res.redirect()`. Closes #92
- Added `--less` support to express(1)
- Added `express.response` prototype
- Added `express.request` prototype
- Added `express.application` prototype
- Added `app.path()`
- Added `app.render()`
- Added `res.type()` to replace `res.contentType()`
- Changed: `res.redirect()` to add relative support
- Changed: enable "jsonp callback" by default
- Changed: renamed "case sensitive routes" to "case sensitive routing"
- Rewrite of all tests with mocha
- Removed "root" setting
- Removed ‘res.redirect('home’)`support`
- `Removed`req.notify()``
- `Removed`app.register()``
- `Removed`app.redirect()``
- `Removed`app.is()``
- `Removed`app.helpers()``
- `Removed`app.dynamicHelpers()``
- `Fixed`res.sendfile()` with non-GET. Closes #723
- Fixed express(1) public dir for windows. Closes #866

``

# 2.5.9/ 2012-04-02

``

``

- Added support for PURGE request method [pbuyle]
- Fixed `express(1)` generated app `app.address()` before `listening` [mmalecki]

``

# 2.5.8 / 2012-02-08

``

``

- Update mkdirp dep. Closes #991

``

# 2.5.7 / 2012-02-06

``

``

- Fixed `app.all` duplicate DELETE requests [mscdex]

``

# 2.5.6 / 2012-01-13

``

``

- Updated hamljs dev dep. Closes #953

``

# 2.5.5 / 2012-01-08

``

``

- Fixed: set `filename` on cached templates [matthewleon]

``

# 2.5.4 / 2012-01-02

``

``

- Fixed `express(1)` eol on 0.4.x. Closes #947

``

# 2.5.3 / 2011-12-30

``

``

- Fixed `req.is()` when a charset is present

``

# 2.5.2 / 2011-12-10

``

``

- Fixed: express(1) LF -> CRLF for windows

``

# 2.5.1 / 2011-11-17

``

``

- Changed: updated connect to 1.8.x
- Removed sass.js support from express(1)

``

# 2.5.0 / 2011-10-24

``

``

- Added ./routes dir for generated app by default
- Added npm install reminder to express(1) app gen
- Added 0.5.x support
- Removed `make test-cov` since it wont work with node 0.5.x
- Fixed express(1) public dir for windows. Closes #866

``

# 2.4.7 / 2011-10-05

``

``

- Added mkdirp to express(1). Closes #795
- Added simple json-config example
- Added shorthand for the parsed request's pathname via `req.path`
- Changed connect dep to 1.7.x to fix npm issue...
- Fixed `res.redirect()` HEAD support. [reported by xerox]
- Fixed `req.flash()`, only escape args
- Fixed absolute path checking on windows. Closes #829 [reported by andrewpmckenzie]

``

# 2.4.6 / 2011-08-22

``

``

- Fixed multiple param callback regression. Closes #824 [reported by TroyGoode]

``

# 2.4.5 / 2011-08-19

``

``

- Added support for routes to handle errors. Closes #809
- Added `app.routes.all()`. Closes #803
- Added "basepath" setting to work in conjunction with reverse proxies etc.
- Refactored `Route` to use a single array of callbacks
- Added support for multiple callbacks for `app.param()`. Closes #801 Closes #805
- Changed: removed .call(self) for route callbacks
- Dependency: `qs >= 0.3.1`
- Fixed `res.redirect()` on windows due to `join()` usage. Closes #808

``

# 2.4.4 / 2011-08-05

``

``

- Fixed `res.header()` intention of a set, even when `undefined`
- Fixed `*`, value no longer required
- Fixed `res.send(204)` support. Closes #771

``

# 2.4.3 / 2011-07-14

``

``

- Added docs for `status` option special-case. Closes #739
- Fixed `options.filename`, exposing the view path to template engines

``

# 2.4.2. / 2011-07-06

``

``

- Revert "removed jsonp stripping" for XSS

``

# 2.4.1 / 2011-07-06

``

``

- Added `res.json()` JSONP support. Closes #737
- Added extending-templates example. Closes #730
- Added "strict routing" setting for trailing slashes
- Added support for multiple envs in `app.configure()` calls. Closes #735
- Changed: `res.send()` using `res.json()`
- Changed: when cookie `path === null` don't default it
- Changed; default cookie path to "home" setting. Closes #731
- Removed pids/logs creation from express(1)

``

# 2.4.0 / 2011-06-28

``

``

- Added chainable `res.status(code)`
- Added `res.json()`, an explicit version of `res.send(obj)`
- Added simple web-service example

``

# 2.3.12 / 2011-06-22

``

``

- #express is now on freenode! come join!
- Added `req.get(field, param)`
- Added links to Japanese documentation, thanks @hideyukisaito!
- Added; the `express(1)` generated app outputs the env
- Added `content-negotiation` example
- Dependency: connect >= 1.5.1 < 2.0.0
- Fixed view layout bug. Closes #720
- Fixed; ignore body on 304. Closes #701

``

# 2.3.11 / 2011-06-04

``

``

- Added `npm test`
- Removed generation of dummy test file from `express(1)`
- Fixed; `express(1)` adds express as a dep
- Fixed; prune on `prepublish`

``

# 2.3.10 / 2011-05-27

``

``

- Added `req.route`, exposing the current route
- Added package.json generation support to `express(1)`
- Fixed call to `app.param()` function for optional params. Closes #682

``

# 2.3.9 / 2011-05-25

``

``

- Fixed bug-ish with ‘../’ in `res.partial()` calls

``

# 2.3.8 / 2011-05-24

``

``

- Fixed `app.options()`

``

# 2.3.7 / 2011-05-23

``

``

- Added route `Collection`, ex: ‘app.get(’/user/:id').remove();``
- `Added support for`app.param(fn)`to define param logic`
- `Removed`app.param()` support for callback with return value
- Removed module.parent check from express(1) generated app. Closes #670
- Refactored router. Closes #639

``

# 2.3.6 / 2011-05-20

``

``

- Changed; using devDependencies instead of git submodules
- Fixed redis session example
- Fixed markdown example
- Fixed view caching, should not be enabled in development

``

# 2.3.5 / 2011-05-20

``

``

- Added export `.view` as alias for `.View`

``

# 2.3.4 / 2011-05-08

``

``

- Added `./examples/say`
- Fixed `res.sendfile()` bug preventing the transfer of files with spaces

``

# 2.3.3 / 2011-05-03

``

``

- Added "case sensitive routes" option.
- Changed; split methods supported per rfc [slaskis]
- Fixed route-specific middleware when using the same callback function several times

``

# 2.3.2 / 2011-04-27

``

``

- Fixed view hints

``

# 2.3.1 / 2011-04-26

``

``

- Added `app.match()` as `app.match.all()`
- Added `app.lookup()` as `app.lookup.all()`
- Added `app.remove()` for `app.remove.all()`
- Added `app.remove.VERB()`
- Fixed template caching collision issue. Closes #644
- Moved router over from connect and started refactor

``

# 2.3.0 / 2011-04-25

``

``

- Added options support to `res.clearCookie()`
- Added `res.helpers()` as alias of `res.locals()`
- Added; json defaults to UTF-8 with `res.send()`. Closes #632. [Daniel * Dependency `connect >= 1.4.0`
- Changed; auto set Content-Type in res.attachement [Aaron Heckmann]
- Renamed "cache views" to "view cache". Closes #628
- Fixed caching of views when using several apps. Closes #637
- Fixed gotcha invoking `app.param()` callbacks once per route middleware. Closes #638
- Fixed partial lookup precedence. Closes #631 Shaw]

``

# 2.2.2 / 2011-04-12

``

``

- Added second callback support for `res.download()` connection errors
- Fixed `filename` option passing to template engine

``

# 2.2.1 / 2011-04-04

``

``

- Added `layout(path)` helper to change the layout within a view. Closes #610
- Fixed `partial()` collection object support. Previously only anything with `.length` would work. When `.length` is present one must still be aware of holes, however now ‘{ collection: {foo: 'bar’}}`is valid, exposes` keyInCollection`and`keysInCollection`.
- Performance improved with better view caching
- Removed `request` and `response` locals
- Changed; errorHandler page title is now `Express` instead of `Connect`

``

# 2.2.0 / 2011-03-30

``

``

- Added `app.lookup.VERB()`, ex ‘app.lookup.put(’/user/:id')`. Closes #606`
- `Added`app.match.VERB()`, ex`app.match.put('/user/12')`. Closes #606`
- `Added`app.VERB(path)`as alias of`app.lookup.VERB()`.`
- `Dependency`connect >= 1.2.0`

``

# 2.1.1 / 2011-03-29

``

``

- Added; expose `err.view` object when failing to locate a view
- Fixed `res.partial()` call `next(err)` when no callback is given [reported by aheckmann]
- Fixed; `res.send(undefined)` responds with 204 [aheckmann]

``

# 2.1.0 / 2011-03-24

``

``

- Added `<root>/_?<name>` partial lookup support. Closes #447
- Added `request`, `response`, and `app` local variables
- Added `settings` local variable, containing the app's settings
- Added `req.flash()` exception if `req.session` is not available
- Added `res.send(bool)` support (json response)
- Fixed stylus example for latest version
- Fixed; wrap try/catch around `res.render()`

``

# 2.0.0 / 2011-03-17

``

``

- Fixed up index view path alternative.
- Changed; `res.locals()` without object returns the locals

``

# 2.0.0rc3 / 2011-03-17

``

``

- Added `res.locals(obj)` to compliment `res.local(key, val)`
- Added `res.partial()` callback support
- Fixed recursive error reporting issue in `res.render()`

``

# 2.0.0rc2 / 2011-03-17

``

``

- Changed; `partial()` "locals" are now optional
- Fixed `SlowBuffer` support. Closes #584 [reported by tyrda01]
- Fixed .filename view engine option [reported by drudge]
- Fixed blog example
- Fixed `{req,res}.app` reference when mounting [Ben Weaver]

``

# 2.0.0rc / 2011-03-14

``

``

- Fixed; expose `HTTPSServer` constructor
- Fixed express(1) default test charset. Closes #579 [reported by secoif]
- Fixed; default charset to utf-8 instead of utf8 for lame IE [reported by NickP]

``

# 2.0.0beta3 / 2011-03-09

``

``

- Added support for `res.contentType()` literal The original ‘res.contentType(’.json')`,` res.contentType('application/json')`, and`res.contentType('json')` will work now.
- Added `res.render()` status option support back
- Added charset option for `res.render()`
- Added `.charset` support (via connect 1.0.4)
- Added view resolution hints when in development and a lookup fails
- Added layout lookup support relative to the page view. For example while rendering `./views/user/index.jade` if you create `./views/user/layout.jade` it will be used in favour of the root layout.
- Fixed `res.redirect()`. RFC states absolute url [reported by unlink]
- Fixed; default `res.send()` string charset to utf8
- Removed `Partial` constructor (not currently used)

``

# 2.0.0beta2 / 2011-03-07

``

``

- Added res.render() `.locals` support back to aid in migration process
- Fixed flash example

``

# 2.0.0beta / 2011-03-03

``

``

- Added HTTPS support
- Added `res.cookie()` maxAge support
- Added `req.header()` Referrer / Referer special-case, either works
- Added mount support for `res.redirect()`, now respects the mount-point
- Added `union()` util, taking place of `merge(clone())` combo
- Added stylus support to express(1) generated app
- Added secret to session middleware used in examples and generated app
- Added `res.local(name, val)` for progressive view locals
- Added default param support to `req.param(name, default)`
- Added `app.disabled()` and `app.enabled()`
- Added `app.register()` support for omitting leading ".", either works
- Added `res.partial()`, using the same interface as `partial()` within a view. Closes #539
- Added `app.param()` to map route params to async/sync logic
- Added; aliased `app.helpers()` as `app.locals()`. Closes #481
- Added extname with no leading "." support to `res.contentType()`
- Added `cache views` setting, defaulting to enabled in "production" env
- Added index file partial resolution, eg: partial('user') may try views/user/index.jade.
- Added `req.accepts()` support for extensions
- Changed; `res.download()` and `res.sendfile()` now utilize Connect's static file server `connect.static.send()`.
- Changed; replaced `connect.utils.mime()` with npm mime module
- Changed; allow `req.query` to be pre-defined (via middleware or other parent
- Changed view partial resolution, now relative to parent view
- Changed view engine signature. no longer `engine.render(str, options, callback)`, now `engine.compile(str, options) -> Function`, the returned function accepts `fn(locals)`.
- Fixed `req.param()` bug returning Array.prototype methods. Closes #552
- Fixed; using `Stream#pipe()` instead of `sys.pump()` in `res.sendfile()`
- Fixed; using qs module instead of querystring
- Fixed; strip unsafe chars from jsonp callbacks
- Removed "stream threshold" setting

``

# 1.0.8 / 2011-03-01

``

``

- Allow `req.query` to be pre-defined (via middleware or other parent app)
- "connect": ">= 0.5.0 < 1.0.0". Closes #547
- Removed the long deprecated EXPRESS_ENV support

``

# 1.0.7 / 2011-02-07

``

``

- Fixed `render()` setting inheritance. Mounted apps would not inherit "view engine"

``

# 1.0.6 / 2011-02-07

``

``

- Fixed `view engine` setting bug when period is in dirname

``

# 1.0.5 / 2011-02-05

``

``

- Added secret to generated app `session()` call

``

# 1.0.4 / 2011-02-05

``

``

- Added `qs` dependency to package.json
- Fixed namespaced `require()`s for latest connect support

``

# 1.0.3 / 2011-01-13

``

``

- Remove unsafe characters from JSONP callback names [Ryan Grove]

``

# 1.0.2 / 2011-01-10

``

``

- Removed nested require, using `connect.router`

``

# 1.0.1 / 2010-12-29

``

``

- Fixed for middleware stacked via `createServer()` previously the `foo` middleware passed to `createServer(foo)` would not have access to Express methods such as `res.send()` or props like `req.query` etc.

``

# 1.0.0 / 2010-11-16

``

``

- Added; deduce partial object names from the last segment. For example by default ‘partial('forum/post’, postObject)` will give you the post object, providing a meaningful default.
- Added http status code string representation to `res.redirect()` body
- Added; `res.redirect()` supporting text/plain and text/html via Accept.
- Added `req.is()` to aid in content negotiation
- Added partial local inheritance [suggested by masylum]. Closes #102 providing access to parent template locals.
- Added -s, –session[s] flag to express(1) to add session related middleware
- Added –template flag to express(1) to specify the template engine to use.
- Added –css flag to express(1) to specify the stylesheet engine to use (or just plain css by default).
- Added `app.all()` support [thanks aheckmann]
- Added partial direct object support. You may now ‘partial('user’, user)`providing the "user" local, vs previously`partial('user', { object: user })`.
- Added route-separation example since many people question ways to do this with CommonJS modules. Also view the blog example for an alternative.
- Performance; caching view path derived partial object names
- Fixed partial local inheritance precedence. [reported by Nick Poulden] Closes #454
- Fixed jsonp support; text/javascript as per mailinglist discussion

``

# 1.0.0rc4 / 2010-10-14

``

``

- Added NODE_ENV support, EXPRESS_ENV is deprecated and will be removed in 1.0.0
- Added route-middleware support (very helpful, see the docs)
- Added jsonp callback setting to enable/disable jsonp autowrapping [Dav Glass]
- Added callback query check on response.send to autowrap JSON objects for simple webservice implementations [Dav Glass]
- Added `partial()` support for array-like collections. Closes #434
- Added support for swappable querystring parsers
- Added session usage docs. Closes #443
- Added dynamic helper caching. Closes #439 [suggested by maritz]
- Added authentication example
- Added basic Range support to `res.sendfile()` (and `res.download()` etc)
- Changed; `express(1)` generated app using 2 spaces instead of 4
- Default env to "development" again [aheckmann]
- Removed context option is no more, use "scope"
- Fixed; exposing _./support_ libs to examples so they can run without installs
- Fixed mvc example

``

# 1.0.0rc3 / 2010-09-20

``

``

- Added confirmation for `express(1)` app generation. Closes #391
- Added extending of flash formatters via `app.flashFormatters`
- Added flash formatter support. Closes #411
- Added streaming support to `res.sendfile()` using `sys.pump()` when >= "stream threshold"
- Added stream threshold setting for `res.sendfile()`
- Added `res.send()` HEAD support
- Added `res.clearCookie()`
- Added `res.cookie()`
- Added `res.render()` headers option
- Added `res.redirect()` response bodies
- Added `res.render()` status option support. Closes #425 [thanks aheckmann]
- Fixed `res.sendfile()` responding with 403 on malicious path
- Fixed `res.download()` bug; when an error occurs remove Content-Disposition
- Fixed; mounted apps settings now inherit from parent app [aheckmann]
- Fixed; stripping Content-Length / Content-Type when 204
- Fixed `res.send()` 204. Closes #419
- Fixed multiple Set-Cookie headers via `res.header()`. Closes #402
- Fixed bug messing with error handlers when `listenFD()` is called instead of `listen()`. [thanks guillermo]

``

# 1.0.0rc2 / 2010-08-17

``

``

- Added `app.register()` for template engine mapping. Closes #390
- Added `res.render()` callback support as second argument (no options)
- Added callback support to `res.download()`
- Added callback support for `res.sendfile()`
- Added support for middleware access via `express.middlewareName()` vs `connect.middlewareName()`
- Added "partials" setting to docs
- Added default expresso tests to `express(1)` generated app. Closes #384
- Fixed `res.sendfile()` error handling, defer via `next()`
- Fixed `res.render()` callback when a layout is used [thanks guillermo]
- Fixed; `make install` creating ~/.node_libraries when not present
- Fixed issue preventing error handlers from being defined anywhere. Closes #387

``

# 1.0.0rc / 2010-07-28

``

``

- Added mounted hook. Closes #369
- Added connect dependency to package.json
- Removed "reload views" setting and support code development env never caches, production always caches.
- Removed param in route callbacks, signature is now simply (req, res, next), previously (req, res, params, next). Use req.params for path captures, req.query for GET params.
- Fixed "home" setting
- Fixed middleware/router precedence issue. Closes #366
- Fixed; configure() callbacks called immediately. Closes #368

``

# 1.0.0beta2 / 2010-07-23

``

``

- Added more examples
- Added; exporting `Server` constructor
- Added `Server#helpers()` for view locals
- Added `Server#dynamicHelpers()` for dynamic view locals. Closes #349
- Added support for absolute view paths
- Added; home setting defaults to `Server#route` for mounted apps. Closes #363
- Added Guillermo Rauch to the contributor list
- Added support for "as" for non-collection partials. Closes #341
- Fixed install.sh, ensuring _~/.node_libraries_ exists. Closes #362 [thanks jf]
- Fixed `res.render()` exceptions, now passed to `next()` when no callback is given [thanks guillermo]
- Fixed instanceof `Array` checks, now `Array.isArray()`
- Fixed express(1) expansion of public dirs. Closes #348
- Fixed middleware precedence. Closes #345
- Fixed view watcher, now async [thanks aheckmann]

``

# 1.0.0beta / 2010-07-15

``

``

- Re-write
  - much faster
  - much lighter
  - Check ExpressJS.com for migration guide and updated docs

``

# 0.14.0 / 2010-06-15

``

``

- Utilize relative requires
- Added Static bufferSize option [aheckmann]
- Fixed caching of view and partial subdirectories [aheckmann]
- Fixed mime.type() comments now that ".ext" is not supported
- Updated haml submodule
- Updated class submodule
- Removed bin/express

``

# 0.13.0 / 2010-06-01

``

``

- Added node v0.1.97 compatibility
- Added support for deleting cookies via Request::cookie('key', null)
- Updated haml submodule
- Fixed not-found page, now using using charset utf-8
- Fixed show-exceptions page, now using using charset utf-8
- Fixed view support due to fs.readFile Buffers
- Changed; mime.type() no longer accepts ".type" due to node extname() changes

``

# 0.12.0 / 2010-05-22

``

``

- Added node v0.1.96 compatibility
- Added view `helpers` export which act as additional local variables
- Updated haml submodule
- Changed ETag; removed inode, modified time only
- Fixed LF to CRLF for setting multiple cookies
- Fixed cookie compilation; values are now urlencoded
- Fixed cookies parsing; accepts quoted values and url escaped cookies

``

# 0.11.0 / 2010-05-06

``

``

- Added support for layouts using different engines
  - this.render('page.html.haml', { layout: 'super-cool-layout.html.ejs' })
  - this.render('page.html.haml', { layout: 'foo' }) // assumes 'foo.html.haml'
  - this.render('page.html.haml', { layout: false }) // no layout
- Updated ext submodule
- Updated haml submodule
- Fixed EJS partial support by passing along the context. Issue #307

``

# 0.10.1 / 2010-05-03

``

``

- Fixed binary uploads.

``

# 0.10.0 / 2010-04-30

``

``

- Added charset support via Request::charset (automatically assigned to 'UTF-8' when respond()'s encoding is set to 'utf8' or 'utf-8'.
- Added "encoding" option to Request::render(). Closes #299
- Added "dump exceptions" setting, which is enabled by default.
- Added simple ejs template engine support
- Added error response support for text/plain, application/json. Closes #297
- Added callback function param to Request::error()
- Added Request::sendHead()
- Added Request::stream()
- Added support for Request::respond(304, null) for empty response bodies
- Added ETag support to Request::sendfile()
- Added options to Request::sendfile(), passed to fs.createReadStream()
- Added filename arg to Request::download()
- Performance enhanced due to pre-reversing plugins so that plugins.reverse() is not called on each request
- Performance enhanced by preventing several calls to toLowerCase() in Router::match()
- Changed; Request::sendfile() now streams
- Changed; Renamed Request::halt() to Request::respond(). Closes #289
- Changed; Using sys.inspect() instead of JSON.encode() for error output
- Changed; run() returns the http.Server instance. Closes #298
- Changed; Defaulting Server::host to null (INADDR_ANY)
- Changed; Logger "common" format scale of 0.4f
- Removed Logger "request" format
- Fixed; Catching ENOENT in view caching, preventing error when "views/partials" is not found
- Fixed several issues with http client
- Fixed Logger Content-Length output
- Fixed bug preventing Opera from retaining the generated session id. Closes #292

``

# 0.9.0 / 2010-04-14

``

``

- Added DSL level error() route support
- Added DSL level notFound() route support
- Added Request::error()
- Added Request::notFound()
- Added Request::render() callback function. Closes #258
- Added "max upload size" setting
- Added "magic" variables to collection partials (__index__, __length__, __isFirst__, __isLast__). Closes #254
- Added haml.js submodule; removed haml-js
- Added callback function support to Request::halt() as 3rd/4th arg
- Added preprocessing of route param wildcards using param(). Closes #251
- Added view partial support (with collections etc)
- Fixed bug preventing falsey params (such as ?page=0). Closes #286
- Fixed setting of multiple cookies. Closes #199
- Changed; view naming convention is now NAME.TYPE.ENGINE (for example page.html.haml)
- Changed; session cookie is now httpOnly
- Changed; Request is no longer global
- Changed; Event is no longer global
- Changed; "sys" module is no longer global
- Changed; moved Request::download to Static plugin where it belongs
- Changed; Request instance created before body parsing. Closes #262
- Changed; Pre-caching views in memory when "cache view contents" is enabled. Closes #253
- Changed; Pre-caching view partials in memory when "cache view partials" is enabled
- Updated support to node –version 0.1.90
- Updated dependencies
- Removed set("session cookie") in favour of use(Session, { cookie: { ... }})
- Removed utils.mixin(); use Object::mergeDeep()

``

# 0.8.0 / 2010-03-19

``

``

- Added coffeescript example app. Closes #242
- Changed; cache api now async friendly. Closes #240
- Removed deprecated 'express/static' support. Use 'express/plugins/static'

``

# 0.7.6 / 2010-03-19

``

``

- Added Request::isXHR. Closes #229
- Added `make install` (for the executable)
- Added `express` executable for setting up simple app templates
- Added "GET /public/*" to Static plugin, defaulting to <root>/public
- Added Static plugin
- Fixed; Request::render() only calls cache.get() once
- Fixed; Namespacing View caches with "view:"
- Fixed; Namespacing Static caches with "static:"
- Fixed; Both example apps now use the Static plugin
- Fixed set("views"). Closes #239
- Fixed missing space for combined log format
- Deprecated Request::sendfile() and 'express/static'
- Removed Server::running

``

# 0.7.5 / 2010-03-16

``

``

- Added Request::flash() support without args, now returns all flashes
- Updated ext submodule

``

# 0.7.4 / 2010-03-16

``

``

- Fixed session reaper
- Changed; class.js replacing js-oo Class implementation (quite a bit faster, no browser cruft)

``

# 0.7.3 / 2010-03-16

``

``

- Added package.json
- Fixed requiring of haml / sass due to kiwi removal

``

# 0.7.2 / 2010-03-16

``

``

- Fixed GIT submodules (HAH!)

``

# 0.7.1 / 2010-03-16

``

``

- Changed; Express now using submodules again until a PM is adopted
- Changed; chat example using millisecond conversions from ext

``

# 0.7.0 / 2010-03-15

``

``

- Added Request::pass() support (finds the next matching route, or the given path)
- Added Logger plugin (default "common" format replaces CommonLogger)
- Removed Profiler plugin
- Removed CommonLogger plugin

``

# 0.6.0 / 2010-03-11

``

``

- Added seed.yml for kiwi package management support
- Added HTTP client query string support when method is GET. Closes #205
- Added support for arbitrary view engines. For example "foo.engine.html" will now require('engine'), the exports from this module are cached after the first require().
- Added async plugin support
- Removed usage of RESTful route funcs as http client get() etc, use http.get() and friends
- Removed custom exceptions

``

# 0.5.0 / 2010-03-10

``

``

- Added ext dependency (library of js extensions)
- Removed extname() / basename() utils. Use path module
- Removed toArray() util. Use arguments.values
- Removed escapeRegexp() util. Use RegExp.escape()
- Removed process.mixin() dependency. Use utils.mixin()
- Removed Collection
- Removed ElementCollection
- Shameless self promotion of ebook "Advanced JavaScript" (http://dev-mag.com) ;)

``

# 0.4.0 / 2010-02-11

``

``

- Added flash() example to sample upload app
- Added high level restful http client module (express/http)
- Changed; RESTful route functions double as HTTP clients. Closes #69
- Changed; throwing error when routes are added at runtime
- Changed; defaulting render() context to the current Request. Closes #197
- Updated haml submodule

``

# 0.3.0 / 2010-02-11

``

``

- Updated haml / sass submodules. Closes #200
- Added flash message support. Closes #64
- Added accepts() now allows multiple args. fixes #117
- Added support for plugins to halt. Closes #189
- Added alternate layout support. Closes #119
- Removed Route::run(). Closes #188
- Fixed broken specs due to use(Cookie) missing

``

# 0.2.1 / 2010-02-05

``

``

- Added "plot" format option for Profiler (for gnuplot processing)
- Added request number to Profiler plugin
- Fixed binary encoding for multipart file uploads, was previously defaulting to UTF8
- Fixed issue with routes not firing when not files are present. Closes #184
- Fixed process.Promise -> events.Promise

``

# 0.2.0 / 2010-02-03

``

``

- Added parseParam() support for name[] etc. (allows for file inputs with "multiple" attr) Closes #180
- Added Both Cache and Session option "reapInterval" may be "reapEvery". Closes #174
- Added expiration support to cache api with reaper. Closes #133
- Added cache Store.Memory::reap()
- Added Cache; cache api now uses first class Cache instances
- Added abstract session Store. Closes #172
- Changed; cache Memory.Store::get() utilizing Collection
- Renamed MemoryStore -> Store.Memory
- Fixed use() of the same plugin several time will always use latest options. Closes #176

``

# 0.1.0 / 2010-02-03

``

``

- Changed; Hooks (before / after) pass request as arg as well as evaluated in their context
- Updated node support to 0.1.27 Closes #169
- Updated dirname(__filename) -> __dirname
- Updated libxmljs support to v0.2.0
- Added session support with memory store / reaping
- Added quick uid() helper
- Added multi-part upload support
- Added Sass.js support / submodule
- Added production env caching view contents and static files
- Added static file caching. Closes #136
- Added cache plugin with memory stores
- Added support to StaticFile so that it works with non-textual files.
- Removed dirname() helper
- Removed several globals (now their modules must be required)

``

# 0.0.2 / 2010-01-10

``

``

- Added view benchmarks; currently haml vs ejs
- Added Request::attachment() specs. Closes #116
- Added use of node's parseQuery() util. Closes #123
- Added `make init` for submodules
- Updated Haml
- Updated sample chat app to show messages on load
- Updated libxmljs parseString -> parseHtmlString
- Fixed `make init` to work with older versions of git
- Fixed specs can now run independent specs for those who can't build deps. Closes #127
- Fixed issues introduced by the node url module changes. Closes 126.
- Fixed two assertions failing due to Collection::keys() returning strings
- Fixed faulty Collection::toArray() spec due to keys() returning strings
- Fixed `make test` now builds libxmljs.node before testing

``

# 0.0.1 / 2010-01-03

``

``

- Initial release