pinwise
Sign in

Public repo page · re-scanned weekly

expressjs/expresstech-debt free score 27/100

ref
master @ 1c6f1b0
scanned
24 Oct 2026, 00:16 UTC
safe window
14 days
Get tickets for this repo

Tech-debt free score

27/100

Rotting

1 critical or high advisory, 11 packages a whole major behind and 11 more behind the safe target.

How we got 27

Outdated majors and critical/high CVEs cost 55 of 73 lost points. Upgrade the 11 packages a major behind first.

  1. 11 majors behind11 × 6 = 66capped at 30costs −30 points, 41% of points lost
  2. 1 critical/high CVEs1 × 25costs −25 points, 34% of points lost
  3. 2 deprecated packages2 × 5costs −10 points, 14% of points lost
  4. 4 minors behind4 × 2costs −8 points, 11% of points lost

Nothing found in: moderate/low CVEs, Node runtime EOL

Debt-free score100 − 73 =27

100 means no dependency debt; below zero means the debt outweighs the whole scale. Every advisory and every version behind costs points.

Summary

expressjs/express scores 27 out of 100 on the tech-debt free score (rotting; 100 means no dependency debt). 1 of its 52 packages carry known advisories, 1 of them critical or high. 11 packages are a whole major version behind and 11 more trail the safe target. The scan covers npm, github-actions and runtime. Last scanned 24 Oct 2026.

Last scanned 24 Oct 2026 · 1 public scan so far · re-scanned about once a week

Packages & tools
52

22 behind the safe target (42%)

Needs action
12

advisory, deprecated or a major behind

Behind target
18

minor or patch behind

Current
22

at or above the safe target

Advisories
1

across 1 package, from OSV.dev

How the 52 packages splitred needs a ticket, amber a bump, green nothing
01 · Worst first

The 5 packages costing expressjs/express the most

Each one links to its row in the table below, with the safe target and the advisories.

  1. body-parser 2.3.0 → 2.3.0

    npm · 1 critical or high advisory

  2. connect-redis 8.0.1 → 10.0.0

    npm · a whole major behind

  3. content-disposition 2.0.1 → 3.0.0

    npm · a whole major behind

  4. content-type 2.0.0 → 3.1.1

    npm · a whole major behind

  5. cookie 0.7.1 → 2.0.1

    npm · a whole major behind

02 · Packages

52 packages, worst first

The safe target is the newest stable release that has been public for at least 14 days. Fresh releases are where supply-chain attacks land.

Showing 10 of 52 packages

Packages with installed, latest and safe target versions
StatusPackageInstalledLatest≥ 14dSafe targetDriftCVEs
Needs actionnpmdependencies · ^2.3.02.3.0declared2.4.022 Oct 2026Latest release is only 1 days old, inside the 14-day window2.3.015 Jun 2026current1

Upgrade path

current
  1. Installed2.3.0 declared, no lockfile
  2. Safe target2.3.015 Jun 2026public for 14+ days
  3. Latest2.4.022 Oct 2026only 1d old, inside the 14-day window

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 1

1 high
  • highCVSS 7.5GHSA-27r3-jxmh-p828

    body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

    CVE-2026-111181fixed in 1.20.9

Research not included on this scan

Breaking changes, the work involved and the new features between 2.3.0 → 2.3.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^2.3.0
Deprecated
No
Needs actionnpmdevDependencies · ^8.0.18.0.1declared10.0.024 Jul 2026Latest release is 91 days old, past the 14-day window10.0.024 Jul 2026major0

Upgrade path

major
  1. Installed8.0.1 declared, no lockfile
  2. Safe target · latest10.0.024 Jul 2026public for 14+ days

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 8.0.1. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 8.0.1 → 10.0.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^8.0.1
Deprecated
No
Needs actionnpmdependencies · ^2.0.12.0.1declared3.0.013 Aug 2026Latest release is 71 days old, past the 14-day window3.0.013 Aug 2026major0

Upgrade path

major
  1. Installed2.0.1 declared, no lockfile
  2. Safe target · latest3.0.013 Aug 2026public for 14+ days

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.1. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2.0.1 → 3.0.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^2.0.1
Deprecated
No
Needs actionnpmdependencies · ^2.0.02.0.0declared3.1.117 Sep 2026Latest release is 36 days old, past the 14-day window3.1.117 Sep 2026major0

Upgrade path

major
  1. Installed2.0.0 declared, no lockfile
  2. Safe target · latest3.1.117 Sep 2026public for 14+ days

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2.0.0 → 3.1.1 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^2.0.0
Deprecated
No
Needs actionnpmdevDependencies · ^3.1.103.1.10declared7.0.218 Oct 2026Latest release is only 5 days old, inside the 14-day window7.0.14 Oct 2026major0

Upgrade path

major
  1. Installed3.1.10 declared, no lockfile
  2. Safe target7.0.14 Oct 2026public for 14+ days
  3. Latest7.0.218 Oct 2026only 5d old, inside the 14-day window

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 3.1.10. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 3.1.10 → 7.0.1 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^3.1.10
Deprecated
No
Needs actionnpmdevDependencies · 8.47.0deprecated8.47.0declared10.13.016 Oct 2026Latest release is only 7 days old, inside the 14-day window10.12.02 Oct 2026major0

Upgrade path

major
  1. Installed8.47.0 declared, no lockfile
  2. Safe target10.12.02 Oct 2026public for 14+ days
  3. Latest10.13.016 Oct 2026only 7d old, inside the 14-day window

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 8.47.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 8.47.0 → 10.12.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
8.47.0
Deprecated
Yes, by its maintainers
Needs actionnpmdevDependencies · ^15.0.315.0.3declared18.1.112 Oct 2026Latest release is only 11 days old, inside the 14-day window18.1.05 Oct 2026major0

Upgrade path

major
  1. Installed15.0.3 declared, no lockfile
  2. Safe target18.1.05 Oct 2026public for 14+ days
  3. Latest18.1.112 Oct 2026only 11d old, inside the 14-day window

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 15.0.3. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 15.0.3 → 18.1.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^15.0.3
Deprecated
No
Needs actionnpmdevDependencies · ^11.7.511.7.5declared12.0.31 Oct 2026Latest release is 22 days old, past the 14-day window12.0.31 Oct 2026major0

Upgrade path

major
  1. Installed11.7.5 declared, no lockfile
  2. Safe target · latest12.0.31 Oct 2026public for 14+ days

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 11.7.5. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 11.7.5 → 12.0.3 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^11.7.5
Deprecated
No
Needs actionnpmdevDependencies · ^17.1.017.1.0declared18.0.022 Feb 2026Latest release is 243 days old, past the 14-day window18.0.022 Feb 2026major0

Upgrade path

major
  1. Installed17.1.0 declared, no lockfile
  2. Safe target · latest18.0.022 Feb 2026public for 14+ days

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 17.1.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 17.1.0 → 18.0.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^17.1.0
Deprecated
No
Needs actionnpmdevDependencies · ^6.3.0deprecated6.3.0declared7.3.12 Oct 2026Latest release is 21 days old, past the 14-day window7.3.12 Oct 2026major0

Upgrade path

major
  1. Installed6.3.0 declared, no lockfile
  2. Safe target · latest7.3.12 Oct 2026public for 14+ days

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 6.3.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 6.3.0 → 7.3.1 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^6.3.0
Deprecated
Yes, by its maintainers
Needs actionnpmdependencies · ^2.1.02.1.0declared3.0.021 Sep 2026Latest release is 32 days old, past the 14-day window3.0.021 Sep 2026major0

Upgrade path

major
  1. Installed2.1.0 declared, no lockfile
  2. Safe target · latest3.0.021 Sep 2026public for 14+ days

A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.1.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2.1.0 → 3.0.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^2.1.0
Deprecated
No
Behindgithub-actionstooling · 3d3c42e5aac5ba805825da76410c181273ba90b13d3c42e5aac5ba805825da76410c181273ba90b1declared7.0.120 Jul 2026Latest release is 95 days old, past the 14-day window7.0.120 Jul 2026unknown0

Upgrade path

unknown
  1. Installed3d3c42e5aac5ba805825da76410c181273ba90b1 declared, no lockfile
  2. Safe target · latest7.0.120 Jul 2026public for 14+ days

Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 3d3c42e5aac5ba805825da76410c181273ba90b1. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 3d3c42e5aac5ba805825da76410c181273ba90b1 → 7.0.1 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
github-actions
Section
tooling
Declared
3d3c42e5aac5ba805825da76410c181273ba90b1
Deprecated
No
Behindgithub-actionstooling · 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c3e5f45b2cfb9172054b4087a40e8e0b5a5461e7cdeclared8.0.27 Oct 2026Latest release is 16 days old, past the 14-day window8.0.27 Oct 2026unknown0

Upgrade path

unknown
  1. Installed3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c declared, no lockfile
  2. Safe target · latest8.0.27 Oct 2026public for 14+ days

Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c → 8.0.2 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
github-actions
Section
tooling
Declared
3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
Deprecated
No
Behindgithub-actionstooling · 820762786026740c76f36085b0efc47a31fe5020820762786026740c76f36085b0efc47a31fe5020declared7.1.08 Oct 2026Latest release is 15 days old, past the 14-day window7.1.08 Oct 2026unknown0

Upgrade path

unknown
  1. Installed820762786026740c76f36085b0efc47a31fe5020 declared, no lockfile
  2. Safe target · latest7.1.08 Oct 2026public for 14+ days

Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 820762786026740c76f36085b0efc47a31fe5020. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 820762786026740c76f36085b0efc47a31fe5020 → 7.1.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
github-actions
Section
tooling
Declared
820762786026740c76f36085b0efc47a31fe5020
Deprecated
No
Behindgithub-actionstooling · 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a043fb46d1a93c77aae656e7c1c64a875d1fc6a0adeclared7.0.27 Oct 2026Latest release is 16 days old, past the 14-day window7.0.27 Oct 2026unknown0

Upgrade path

unknown
  1. Installed043fb46d1a93c77aae656e7c1c64a875d1fc6a0a declared, no lockfile
  2. Safe target · latest7.0.27 Oct 2026public for 14+ days

Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → 7.0.2 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
github-actions
Section
tooling
Declared
043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
Deprecated
No
Behindgithub-actionstooling · 8d6379e14d29928660c4ba802d8e85393440b3298d6379e14d29928660c4ba802d8e85393440b329declared2.3.827 Jul 2026Latest release is 88 days old, past the 14-day window2.3.827 Jul 2026unknown0

Upgrade path

unknown
  1. Installed8d6379e14d29928660c4ba802d8e85393440b329 declared, no lockfile
  2. Safe target · latest2.3.827 Jul 2026public for 14+ days

Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 8d6379e14d29928660c4ba802d8e85393440b329. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 8d6379e14d29928660c4ba802d8e85393440b329 → 2.3.8 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
github-actions
Section
tooling
Declared
8d6379e14d29928660c4ba802d8e85393440b329
Deprecated
No
Behindgithub-actionstooling · 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c22892aa5e19bbd11bc0cff5427e3b750a04d9e3c2declaredcodeql-bundle-v2.27.320 Oct 2026Latest release is only 3 days old, inside the 14-day window-unknown0

Upgrade path

unknown
  1. Installed2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 declared, no lockfile
  2. Safe target- no release has cleared the window yet
  3. Latestcodeql-bundle-v2.27.320 Oct 2026only 3d old, inside the 14-day window

Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 → target are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
github-actions
Section
tooling
Declared
2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
Deprecated
No
Behindgithub-actionstooling · 2d1146689b8cda280b9bc96326124645441f03bc2d1146689b8cda280b9bc96326124645441f03bcdeclared2.5.012 Oct 2026Latest release is only 11 days old, inside the 14-day window-unknown0

Upgrade path

unknown
  1. Installed2d1146689b8cda280b9bc96326124645441f03bc declared, no lockfile
  2. Safe target- no release has cleared the window yet
  3. Latest2.5.012 Oct 2026only 11d old, inside the 14-day window

Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2d1146689b8cda280b9bc96326124645441f03bc. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2d1146689b8cda280b9bc96326124645441f03bc → target are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
github-actions
Section
tooling
Declared
2d1146689b8cda280b9bc96326124645441f03bc
Deprecated
No
Behindnpmdependencies · ^4.4.04.4.0declared4.4.313 Sep 2025Latest release is 405 days old, past the 14-day window4.4.313 Sep 2025patch0

Upgrade path

patch
  1. Installed4.4.0 declared, no lockfile
  2. Safe target · latest4.4.313 Sep 2025public for 14+ days

A patch behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 4.4.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 4.4.0 → 4.4.3 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^4.4.0
Deprecated
No
BehindnpmdevDependencies · ^1.18.11.18.1declared1.19.022 Jan 2026Latest release is 274 days old, past the 14-day window1.19.022 Jan 2026minor0

Upgrade path

minor
  1. Installed1.18.1 declared, no lockfile
  2. Safe target · latest1.19.022 Jan 2026public for 14+ days

A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.18.1. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 1.18.1 → 1.19.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
devDependencies
Declared
^1.18.1
Deprecated
No
Behindnpmdependencies · ^2.1.02.1.0declared2.1.11 Dec 2025Latest release is 326 days old, past the 14-day window2.1.11 Dec 2025patch0

Upgrade path

patch
  1. Installed2.1.0 declared, no lockfile
  2. Safe target · latest2.1.11 Dec 2025public for 14+ days

A patch behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.1.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2.1.0 → 2.1.1 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^2.1.0
Deprecated
No
Behindnpmdependencies · ^2.0.02.0.0declared2.0.120 Nov 2025Latest release is 337 days old, past the 14-day window2.0.120 Nov 2025patch0

Upgrade path

patch
  1. Installed2.0.0 declared, no lockfile
  2. Safe target · latest2.0.120 Nov 2025public for 14+ days

A patch behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2.0.0 → 2.0.1 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^2.0.0
Deprecated
No
Behindnpmdependencies · ^3.0.03.0.0declared3.0.220 Nov 2025Latest release is 337 days old, past the 14-day window3.0.220 Nov 2025patch0

Upgrade path

patch
  1. Installed3.0.0 declared, no lockfile
  2. Safe target · latest3.0.220 Nov 2025public for 14+ days

A patch behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 3.0.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 3.0.0 → 3.0.2 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^3.0.0
Deprecated
No
Behindnpmdependencies · ^1.2.11.2.1declared1.3.025 Jun 2026Latest release is 120 days old, past the 14-day window1.3.025 Jun 2026minor0

Upgrade path

minor
  1. Installed1.2.1 declared, no lockfile
  2. Safe target · latest1.3.025 Jun 2026public for 14+ days

A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.2.1. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 1.2.1 → 1.3.0 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^1.2.1
Deprecated
No
Behindnpmdependencies · ^1.1.01.1.0declared1.2.115 Dec 2025Latest release is 312 days old, past the 14-day window1.2.115 Dec 2025minor0

Upgrade path

minor
  1. Installed1.1.0 declared, no lockfile
  2. Safe target · latest1.2.115 Dec 2025public for 14+ days

A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.1.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 1.1.0 → 1.2.1 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^1.1.0
Deprecated
No
Behindnpmdependencies · ^2.2.02.2.0declared2.2.115 Dec 2025Latest release is 312 days old, past the 14-day window2.2.115 Dec 2025patch0

Upgrade path

patch
  1. Installed2.2.0 declared, no lockfile
  2. Safe target · latest2.2.115 Dec 2025public for 14+ days

A patch behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.2.0. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2.2.0 → 2.2.1 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^2.2.0
Deprecated
No
Behindnpmdependencies · ^2.0.12.0.1declared2.0.26 Jun 2025Latest release is 504 days old, past the 14-day window2.0.26 Jun 2025patch0

Upgrade path

patch
  1. Installed2.0.1 declared, no lockfile
  2. Safe target · latest2.0.26 Jun 2025public for 14+ days

A patch behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.1. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 2.0.1 → 2.0.2 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
npm
Section
dependencies
Declared
^2.0.1
Deprecated
No
Behindruntimetooling · >= 1818declared26.12.121 Oct 2026Latest release is only 3 days old, inside the 14-day window18.20.827 Mar 2025minor0

Upgrade path

minor
  1. Installed18 declared, no lockfile
  2. Safe target18.20.827 Mar 2025public for 14+ days
  3. Latest26.12.121 Oct 2026only 3d old, inside the 14-day window

A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 18. Checked against OSV.

Research not included on this scan

Breaking changes, the work involved and the new features between 18 → 18.20.8 are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched.

Sign up to research this upgradeAlready have an account? Sign in
Ecosystem
runtime
Section
tooling
Declared
>= 18
Deprecated
No
Currentnpmdependencies · ^2.0.02.0.0declared1.3.82 Feb 2022Latest release is 1724 days old, past the 14-day window2.0.031 Aug 2024current0

Upgrade path

current
  1. Installed2.0.0 declared, no lockfile
  2. Safe target2.0.031 Aug 2024public for 14+ days
  3. Latest1.3.82 Feb 20221724d public, past the window

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.0. Checked against OSV.

Nothing to research: accepts is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^2.0.0
Deprecated
No
CurrentnpmdevDependencies · 0.8.20.8.2declared0.8.216 Aug 2016Latest release is 3720 days old, past the 14-day window0.8.216 Aug 2016current0

Upgrade path

current
  1. Installed0.8.2 declared, no lockfile
  2. Safe target · latest0.8.216 Aug 2016public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 0.8.2. Checked against OSV.

Nothing to research: after is at its safe target with no known advisories.

Ecosystem
npm
Section
devDependencies
Declared
0.8.2
Deprecated
No
Currentnpmdependencies · ^2.0.02.0.0declared2.0.026 Oct 2018Latest release is 2919 days old, past the 14-day window2.0.026 Oct 2018current0

Upgrade path

current
  1. Installed2.0.0 declared, no lockfile
  2. Safe target · latest2.0.026 Oct 2018public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.0. Checked against OSV.

Nothing to research: depd is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^2.0.0
Deprecated
No
Currentnpmdependencies · ^2.0.02.0.0declared2.0.029 Mar 2024Latest release is 939 days old, past the 14-day window2.0.029 Mar 2024current0

Upgrade path

current
  1. Installed2.0.0 declared, no lockfile
  2. Safe target · latest2.0.029 Mar 2024public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.0. Checked against OSV.

Nothing to research: encodeurl is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^2.0.0
Deprecated
No
Currentnpmdependencies · ^1.0.31.0.3declared1.0.31 Sep 2015Latest release is 4070 days old, past the 14-day window1.0.31 Sep 2015current0

Upgrade path

current
  1. Installed1.0.3 declared, no lockfile
  2. Safe target · latest1.0.31 Sep 2015public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.0.3. Checked against OSV.

Nothing to research: escape-html is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^1.0.3
Deprecated
No
Currentnpmdependencies · ^1.8.11.8.1declared1.8.113 Sep 2017Latest release is 3327 days old, past the 14-day window1.8.113 Sep 2017current0

Upgrade path

current
  1. Installed1.8.1 declared, no lockfile
  2. Safe target · latest1.8.113 Sep 2017public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.8.1. Checked against OSV.

Nothing to research: etag is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^1.8.1
Deprecated
No
Currentnpmdependencies · ^2.0.02.0.0declared0.5.214 Sep 2017Latest release is 3326 days old, past the 14-day window2.0.04 Sep 2024current0

Upgrade path

current
  1. Installed2.0.0 declared, no lockfile
  2. Safe target2.0.04 Sep 2024public for 14+ days
  3. Latest0.5.214 Sep 20173326d public, past the window

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.0. Checked against OSV.

Nothing to research: fresh is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^2.0.0
Deprecated
No
CurrentnpmdevDependencies · 4.3.14.3.1declared4.4.022 Oct 2026Latest release is only 1 days old, inside the 14-day window4.3.111 Sep 2026current0

Upgrade path

current
  1. Installed4.3.1 declared, no lockfile
  2. Safe target4.3.111 Sep 2026public for 14+ days
  3. Latest4.4.022 Oct 2026only 1d old, inside the 14-day window

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 4.3.1. Checked against OSV.

Nothing to research: hbs is at its safe target with no known advisories.

Ecosystem
npm
Section
devDependencies
Declared
4.3.1
Deprecated
No
Currentnpmdependencies · ^2.0.02.0.0declared2.0.016 Nov 2023Latest release is 1072 days old, past the 14-day window2.0.016 Nov 2023current0

Upgrade path

current
  1. Installed2.0.0 declared, no lockfile
  2. Safe target · latest2.0.016 Nov 2023public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.0. Checked against OSV.

Nothing to research: merge-descriptors is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^2.0.0
Deprecated
No
CurrentnpmdevDependencies · 3.0.03.0.0declared3.0.012 Jul 2018Latest release is 3025 days old, past the 14-day window3.0.012 Jul 2018current0

Upgrade path

current
  1. Installed3.0.0 declared, no lockfile
  2. Safe target · latest3.0.012 Jul 2018public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 3.0.0. Checked against OSV.

Nothing to research: method-override is at its safe target with no known advisories.

Ecosystem
npm
Section
devDependencies
Declared
3.0.0
Deprecated
No
CurrentnpmdevDependencies · 1.12.11.12.1declared1.12.111 Sep 2026Latest release is 42 days old, past the 14-day window1.12.111 Sep 2026current0

Upgrade path

current
  1. Installed1.12.1 declared, no lockfile
  2. Safe target · latest1.12.111 Sep 2026public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.12.1. Checked against OSV.

Nothing to research: morgan is at its safe target with no known advisories.

Ecosystem
npm
Section
devDependencies
Declared
1.12.1
Deprecated
No
Currentnpmdependencies · ^2.4.12.4.1declared2.4.222 Oct 2026Latest release is only 1 days old, inside the 14-day window2.4.122 Feb 2022current0

Upgrade path

current
  1. Installed2.4.1 declared, no lockfile
  2. Safe target2.4.122 Feb 2022public for 14+ days
  3. Latest2.4.222 Oct 2026only 1d old, inside the 14-day window

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.4.1. Checked against OSV.

Nothing to research: on-finished is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^2.4.1
Deprecated
No
Currentnpmdependencies · ^1.4.01.4.0declared1.4.06 Sep 2016Latest release is 3699 days old, past the 14-day window1.4.06 Sep 2016current0

Upgrade path

current
  1. Installed1.4.0 declared, no lockfile
  2. Safe target · latest1.4.06 Sep 2016public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.4.0. Checked against OSV.

Nothing to research: once is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^1.4.0
Deprecated
No
Currentnpmdependencies · ^1.3.31.3.3declared1.3.316 Apr 2019Latest release is 2747 days old, past the 14-day window1.3.316 Apr 2019current0

Upgrade path

current
  1. Installed1.3.3 declared, no lockfile
  2. Safe target · latest1.3.316 Apr 2019public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.3.3. Checked against OSV.

Nothing to research: parseurl is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^1.3.3
Deprecated
No
CurrentnpmdevDependencies · 1.2.11.2.1declared1.2.129 Sep 2016Latest release is 3676 days old, past the 14-day window1.2.129 Sep 2016current0

Upgrade path

current
  1. Installed1.2.1 declared, no lockfile
  2. Safe target · latest1.2.129 Sep 2016public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.2.1. Checked against OSV.

Nothing to research: pbkdf2-password is at its safe target with no known advisories.

Ecosystem
npm
Section
devDependencies
Declared
1.2.1
Deprecated
No
Currentnpmdependencies · ^2.0.82.0.8declared2.0.815 Sep 2026Latest release is 38 days old, past the 14-day window2.0.815 Sep 2026current0

Upgrade path

current
  1. Installed2.0.8 declared, no lockfile
  2. Safe target · latest2.0.815 Sep 2026public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.0.8. Checked against OSV.

Nothing to research: proxy-addr is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^2.0.8
Deprecated
No
Currentnpmdependencies · ^6.16.06.16.0declared6.16.114 Oct 2026Latest release is only 9 days old, inside the 14-day window6.16.029 Aug 2026current0

Upgrade path

current
  1. Installed6.16.0 declared, no lockfile
  2. Safe target6.16.029 Aug 2026public for 14+ days
  3. Latest6.16.114 Oct 2026only 9d old, inside the 14-day window

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 6.16.0. Checked against OSV.

Nothing to research: qs is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^6.16.0
Deprecated
No
Currentnpmdependencies · ^2.2.02.2.0declared2.2.027 Mar 2025Latest release is 575 days old, past the 14-day window2.2.027 Mar 2025current0

Upgrade path

current
  1. Installed2.2.0 declared, no lockfile
  2. Safe target · latest2.2.027 Mar 2025public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 2.2.0. Checked against OSV.

Nothing to research: router is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^2.2.0
Deprecated
No
Currentnpmdependencies · ^1.1.21.1.2declared1.1.224 Sep 2017Latest release is 3316 days old, past the 14-day window1.1.224 Sep 2017current0

Upgrade path

current
  1. Installed1.1.2 declared, no lockfile
  2. Safe target · latest1.1.224 Sep 2017public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 1.1.2. Checked against OSV.

Nothing to research: vary is at its safe target with no known advisories.

Ecosystem
npm
Section
dependencies
Declared
^1.1.2
Deprecated
No
CurrentnpmdevDependencies · ~3.0.23.0.2declared3.0.213 Oct 2015Latest release is 4028 days old, past the 14-day window3.0.213 Oct 2015current0

Upgrade path

current
  1. Installed3.0.2 declared, no lockfile
  2. Safe target · latest3.0.213 Oct 2015public for 14+ days

Already at the safe target. The safe target is the newest stable release public for at least 14 days.

Advisories 0

No known advisories for 3.0.2. Checked against OSV.

Nothing to research: vhost is at its safe target with no known advisories.

Ecosystem
npm
Section
devDependencies
Declared
~3.0.2
Deprecated
No
03 · Tickets

33 tickets, in the order to do them

Each one is a complete brief your coding agent can execute. A ticket only turns green when a rescan proves the lockfile moved.

What is in a ticket
  1. P0cve
    TDB-0003L2 body-parser

    Fix 1 advisory in body-parser: 2.3.0 → 2.3.0

    body-parser2.3.02.3.0

    body-parser 2.3.0 in expressjs/express has 1 known advisory (1 high). Upgrade 2.3.0 → 2.3.0 so the installed version is no longer affected.

    • The manifest pins body-parser at exactly 2.3.0 — no ^, ~ or range.
    • The lockfile is regenerated with the project's package manager, resolves body-parser to the target, and nothing newer than the target slipped in.
    • A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
    • Tests, lint, typecheck and build all pass, and your report contains their real output.
    • No API that the release notes mark as removed remains in the code.
    • A rescan of your branch shows no advisories for this package.
    • No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.

    after TDB-0002

  2. P1major
    TDB-0004L3 eslint

    Upgrade eslint 8.47.0 → 10.12.0

    eslint8.47.010.12.0

    eslint in expressjs/express is marked deprecated by its maintainers. Move to 10.12.0 if that release is not deprecated; otherwise replace the package with the maintained successor named in its deprecation notice.

    • The manifest pins eslint at exactly 10.12.0 — no ^, ~ or range.
    • The lockfile is regenerated with the project's package manager, resolves eslint to the target, and nothing newer than the target slipped in.
    • A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
    • Tests, lint, typecheck and build all pass, and your report contains their real output.
    • No API that the release notes mark as removed remains in the code.
    • The package is no longer deprecated at the pinned version, or it has been replaced by its maintained successor.
    • No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.

    after TDB-0002

  3. P1major
    TDB-0005L4 supertest

    Upgrade supertest 6.3.0 → 7.3.1

    supertest6.3.07.3.1

    supertest in expressjs/express is marked deprecated by its maintainers. Move to 7.3.1 if that release is not deprecated; otherwise replace the package with the maintained successor named in its deprecation notice.

    • The manifest pins supertest at exactly 7.3.1 — no ^, ~ or range.
    • The lockfile is regenerated with the project's package manager, resolves supertest to the target, and nothing newer than the target slipped in.
    • A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
    • Tests, lint, typecheck and build all pass, and your report contains their real output.
    • No API that the release notes mark as removed remains in the code.
    • The package is no longer deprecated at the pinned version, or it has been replaced by its maintained successor.
    • No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.

    after TDB-0002

30 more tickets in this queue

Sign in to see every ticket with its research, then point Claude Code or Cursor at the queue over MCP.

See all 33 tickets

Free, no card needed

04 · Questions

About expressjs/express's dependencies

Does expressjs/express have known vulnerabilities?

Yes. The latest scan found 1 known advisory across 1 package, 1 rated critical or high. Advisories come from OSV and are matched against the installed versions in the lockfile.

How outdated are expressjs/express’s dependencies?

22 of its packages are behind the safe target (the newest stable release that has been public for at least 14 days). 11 packages are a whole major version behind. The tech-debt free score is 27/100. 100 means no dependency debt; below zero means the debt outweighs the whole scale.

Which package ecosystems does expressjs/express use?

npm, github-actions and runtime (52 packages in the manifests and lockfiles pinwise read).

When was expressjs/express last scanned?

24 Oct 2026. Public repo pages are re-scanned about once a week, and anyone can request a fresh scan from the free scanner.

05 · Share

Put the score where people look

For maintainers

Is this your repo?

Claim expressjs/express to turn this report into a working plan, or decide whether this public page stays up.

  • Watch itWeekly re-scans and a nudge when a fix lands or a CVE appears.
  • TicketsEvery finding as a ready-to-ship ticket your coding agent can close.
  • Private scansScan branches and private repos inside your workspace.
  • BadgeA live debt-free score badge for your README.
Sign in with GitHub to claimHide or remove this page

Only the repo's owner can claim or change this page. We verify through your GitHub login, a connected workspace or the GitHub App installation, never a form.

Search visibility and removal

Pinwise scans public repositories from their manifests and lockfiles only. If you own expressjs/express, you can keep this page out of search engines or remove it. Private scans inside the app are not affected.

Sign in with the GitHub account that owns the repo to hide or remove this page yourself.