# Express 5

`express/express-5` · Skill · v1.0.0

Write, upgrade and harden Express 5.x APIs, including the route syntax and the silent 4-to-5 changes that still return 200.

Current knowledge for Express 5.3: path-to-regexp 8 route syntax (named wildcards, optional groups), the breaking changes that throw and the ones that silently change responses (res.send(status), res.json(obj, status), res.redirect('back'), the req.query getter and simple parser, urlencoded extended=false, req.body undefined), async error forwarding, JSON error handlers that never leak internals, and production defaults. Includes a grep-driven migration checklist from Express 4.

## Verdict

- level: **submitted** — In the catalog, not yet checked for this digest.
- uplift: **untested** — No runs exist for this digest.
- digest: `sha256:91ae74e545bb8ced5c0176e651577596d46ccab2b1b04bf3e1824b37d12c6b5d`

## Uplift runs

None for this digest. Untested is not the same as useless: nobody has measured it yet.

## Security

No checks recorded for this digest.

## Compatibility

| agent | targeted | compiled | evaluated |
| --- | --- | --- | --- |
| Claude Code | yes | no record | no record |
| Codex | yes | no record | no record |
| Cursor | yes | no record | no record |
| GitHub Copilot | yes | no record | no record |
| Gemini CLI | yes | no record | no record |
| OpenCode | yes | no record | no record |

## Permissions

- network: none
- shell: grep, npm ls, npm test, node
- filesystem: write
- env: none

## Files

- `SKILL.md` 17339 B sha256:1a9de0c259f83a8c66aed831e8a0736393db1499c767d15ed62c99b2d4e3809a
- `references/errors-and-hardening.md` 8746 B sha256:495a6a43aa6e5e2717e278fe1bfa92a6f266da93ef758ecc3f0286ea2b620267
- `references/migration-checklist.md` 7853 B sha256:57dbfe41d195c3cf2fe1cb01c607e29453ff6d94b1546f47387ae687cb3c9654
- `references/routing.md` 5015 B sha256:be3bd2526ca2fe528199cf69c3787056c30abd9fa4ac746b2352a78c9059b8ac
- `references/sources.md` 1617 B sha256:61a0ea2c55b13d788fcdaa2d13a2aa50f13a23bd602ccb67c23d0cf0da58e947

## Limitations

- Written and checked against express@5.3.0 (router 2.2, path-to-regexp 8.4, body-parser 2.4). Later 5.x releases may change details such as defaults or MIME types.
- Covers Express itself. Third-party middleware (sessions, auth, rate limiting, helmet) is mentioned only where it interacts with Express 5 behaviour.
- The migration greps are line-based and can miss calls split across lines; they narrow the search but do not replace reading the code.
- Does not cover the view/template layer beyond noting that res.render is always asynchronous.

## Install

```sh
npx sigil add express/express-5 --agent claude-code,codex,cursor
```

Source: https://github.com/dgesteves/sigil/tree/5cb851d5b2f2f14446ddf631ef5e91bf9d3263dd/catalog/skills/express/express-5