Release: 4.21.2

[UlisesGascon]

Plan to release it on Nov 06

What's included in the HISTORY.md

• deps: path-to-regexp@0.1.12
  • fix backtracking protection
• deps: path-to-regexp@0.1.11
  • Throws an error on invalid path values

What's Changed

• Add funding field (v4) by @bjohansebas in Add funding field (v4) #6065
• deps: path-to-regexp@0.1.11 by @blakeembrey in deps: path-to-regexp@0.1.11 #5956
• deps: path-to-regexp@0.1.12 by @jonchurch in deps: bump path-to-regexp@0.1.12 #6209

Full Changelog: 4.21.1...4.x

[wesleytodd]

Same comment as here: expressjs/discussions#228 (comment)

I think we need more eyes on the funding field before we publish. Ideally a change like this would be reviewed by a few members of the TC before landing since it is often considered a sensitive issue.

[NewEraCracker]

Just release it. It is Oct 31st.

The funding field is only some metadata npm adds on the package-lock.json for people who install this version.

[UlisesGascon]

We plan to include a security patch too so this release is on hold now

[NewEraCracker]

@UlisesGascon

We plan to include a security patch too so this release is on hold now

Can you please disclose how serious (low, medium, high) it is? Does it impact a dependency or express code itself? Can it be sorted by npm overrides?

We are kind of aggressive with user input and never pass untrusted/unfiltered parameters to express functions.

[wesleytodd]

I believe we are undecided if it is really a security issue after investigation. And even if we were we would not disclose information about it until we had a patch.