2026-04-27 Express TC Meeting

[github-actions]

Date/Time

Timezone	Date/Time
America/Los_Angeles	Mon, Apr 27, 2026, 11:00 AM
America/Denver	Mon, Apr 27, 2026, 12:00 PM
America/Chicago	Mon, Apr 27, 2026, 01:00 PM
America/Bogota	Mon, Apr 27, 2026, 01:00 PM
America/New_York	Mon, Apr 27, 2026, 02:00 PM
UTC	Mon, Apr 27, 2026, 06:00 PM
Europe/London	Mon, Apr 27, 2026, 07:00 PM
Europe/Madrid	Mon, Apr 27, 2026, 08:00 PM
Europe/Paris	Mon, Apr 27, 2026, 08:00 PM
Europe/Warsaw	Mon, Apr 27, 2026, 08:00 PM
Europe/Moscow	Mon, Apr 27, 2026, 09:00 PM
Asia/Kolkata	Mon, Apr 27, 2026, 11:30 PM
Asia/Shanghai	Tue, Apr 28, 2026, 02:00 AM
Asia/Tokyo	Tue, Apr 28, 2026, 03:00 AM
Australia/Sydney	Tue, Apr 28, 2026, 04:00 AM

Or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=2026-04-27%20Express%20TC%20Meeting&iso=20260427T1800&p1=1440&ah=1

Agenda

• Enable Organization Billing for GitHub Codespaces in express/pillarjs/jshttp Repositories #488
  • Left a comment on this, lets explore what gratis offerings GH can give us before we decide to pay for something that is only used by 1 or few people in the org
• docs: add YesWeHack policy security-wg#90
  • Parking this for now. The future of paid bounty programs is in the air, lets look for an OpenJS level conversation about this. Removed agenda label comment
• Free form discussion about the state and workload of vuln reporting, ways to help stem the tide etc etc.
  • Resourcing problem, time is ultimately the issue here. Unclear what can fix or reduce the invalid reports coming in, @UlisesGascon idea being used in Lodash is updating the threat model w/ more context about some rejected classes of issues, to hopefully better inform folks and their agents before they even open a report that we will ulltimately close.

Proposed Topics

Extracted from tc agenda labelled issues and pull requests from expressjs/discussions prior to the meeting.

• New CORS playground #468
• Batch governance changes and present to CPC #466
• Access to Cloudflare Analytics for the Website Captains #465
• Have a Google Search Console account #464
• Use Node.js built-in debug and deprecated utilities instead of relying on external packages. #459
• Proposal: Unify the three GitHub organizations #458
• Create a .github-private repo expressjs #447
• docs: new Collaborator role #486
• docs: update governance to allow long-term contributors to be nominated as committers and captains #485
• docs: update expressjs.com members and add emeritus section #460
• Rfc for reusable workflows naming repository #455
• Default workflows part of all repositories #444
• Reusable workflows for npm publish #443

Invited

• @expressjs/express-tc
• @expressjs/triagers
• @expressjs/security-wg

Observers/Guests

This meeting is open for anyone who wants to attend. Reminder to follow our Code of Conduct.

Joining the meeting

• link for participants: https://zoom-lfx.platform.linuxfoundation.org/meeting/95266714809?password=f37cff1b-cb3a-4a21-9425-210e4714c72e

---

Please use the following emoji reactions in this post to indicate your
availability.

• 👍 - Attending
• 👎 - Not attending
• 😕 - Not sure yet