Skill · express/express-5 · v1.0.0 · MIT
Express 5
Write, upgrade and harden Express 5.x APIs, including the route syntax and the silent 4-to-5 changes that still return 200.
Current knowledge for Express 5.3: path-to-regexp 8 route syntax (named wildcards, optional groups), the breaking changes that throw and the ones that silently change responses (res.send(status), res.json(obj, status), res.redirect('back'), the req.query getter and simple parser, urlencoded extended=false, req.body undefined), async error forwarding, JSON error handlers that never leak internals, and production defaults. Includes a grep-driven migration checklist from Express 4.
- Backend
- Security
- Migration
- build
- maintain
- secure
- express
- nodejs
- javascript
- typescript
uplift
No runs exist for this digest.
Not measured for this digest.
Untested is not the same as useless: nobody has measured it yet. Proof comes from A/B runs on hidden tests:
npx sigil prove catalog/skills/express/express-5 --suite <suite> --runs 6trust level · submitted
- in the catalog: met
- structure check: not met
- static scan, no high findings: not met
- canary sandbox passed: not met
- maintainer approved: not met
canary sandbox
Not run for this digest.
static scan
Not run for this digest.
compatibility · targeted, compiled and evaluated are separate claims
| agent | targeted by author | compiled | evaluated in the lab | notes |
|---|---|---|---|---|
| Claude Code | targeted: yes | no record for compiled | no record for evaluated | |
| Codex | targeted: yes | no record for compiled | no record for evaluated | |
| Cursor | targeted: yes | no record for compiled | no record for evaluated | |
| GitHub Copilot | targeted: yes | no record for compiled | no record for evaluated | |
| Gemini CLI | targeted: yes | no record for compiled | no record for evaluated | |
| OpenCode | targeted: yes | no record for compiled | no record for evaluated |
declared permissions
- network
- none
- shell
- grep, npm ls, npm test, node
- filesystem
- write
- env
- none
Undeclared access is a finding in the scan and a tripwire in the canary.
source
- path
- catalog/skills/express/express-5
- authors
- dgesteves
- entry
- SKILL.md (agent-skill)
- registry
- 2026-11-02 · 5cb851d
install
$ npx sigil add express/express-5 --agent claude-codeNo compile record for Claude Code on this digest. Install never runs capability scripts, and refuses on any digest mismatch.
known limitations
- Written and checked against express@5.3.0 (router 2.2, path-to-regexp 8.4, body-parser 2.4). Later 5.x releases may change details such as defaults or MIME types.
- Covers Express itself. Third-party middleware (sessions, auth, rate limiting, helmet) is mentioned only where it interacts with Express 5 behaviour.
- The migration greps are line-based and can miss calls split across lines; they narrow the search but do not replace reading the code.
- Does not cover the view/template layer beyond noting that res.render is always asynchronous.