## expressjs/express — v5.0.0-beta.3…v5.0.0

_85 commits._

### Features
- **feat: upgrade to serve-static@0.16.0** (4c9ddc1)
- **feat: upgrade to send@0.19.0 (#5928)** (9ebe5d5)
- **feat: upgrade to body-parser@1.20.3 (#5926)** (ec4a01b)
- **feat(deps)!: router@^2.0.0 (#5885)** (0264908)
- **feat: adopt Node@18 as the minimum supported version (#5803)** (160b91c)
- **💚 add legacy CI, clean up** (088856c)
- **📝 update people, add ctcpip to TC (#5683)** (6d08471)
- **Add @UlisesGascon to mime repos** (a7d6d29)
- **List and sort all projects, add captains** (897290b)
- **doc: add table of contents, tc/triager lists to readme (#5619)** (700349f)
- **add support Node.js@22 in the CI (#5627)** (4b9cd2f)
- **feat: adopt Node@18 as the minimum supported version** (4b3b8cc)
- **add jonchurch as repo captain on several packages** (7f9e584)
- **add develop to branches** (d546f93)
- **feat: document beta releases expectations** (51595d4)

### Fixes
- **fix(deps): send@^1.1.0** (0c49926)
- **fix(deps): serve-static@^2.1.0** (b3906cb)
- **fix(deps): body-parser@^2.0.1** (fed8c2a)
- **fix: don't render redirect values in anchor href** (54271f6)
- **fix(deps): finalhandler@^2.0.0 (#5899)** (accafc6)
- **fix(deps)!: content-disposition@^1.0.0 (#5884)** (05f40f4)
- **fix(deps): type-is@^2.0.0 (#5883)** (402e7f6)
- **fix(deps)!: mime-types@^3.0.0 (#5882)** (4e61d01)
- **fix(deps): accepts@^2.0.0 (#5881)** (7748475)
- **fix(deps) serve-staic@2.0.0 (#5790)** (65b6206)
- **fix(deps)!: send@^1.0.0 (#5786)** (ecf762f)
- **Fix Contributor Covenant link definition reference in attribution section (#5762)** (2ec589c)
- **Improved fix for open redirect allow list bypass** (0b74695)

### Backend
- **5.0.0** (344b022)
- **Delete `back` as a magic string (#5933)** (bdd81f8)
- **🔧 update CI, remove unsupported versions, clean up** (6c98f80)
- **Merge branch '5.0' into 5-merge** (f9256ef)
- **Merge tag '4.20.0' into 5.0** (e5feb9f)
- **4.20.0** (21df421)
- **update to fresh@2.0.0 (#5916)** (4d713d2)
- **path-to-regexp@0.1.10 (#5902)** (125bb74)
- **cookie-signature@^1.2.1 (#5833)** (91a58b5)
- **merge-descriptors@1.0.3 (#5781)** (2a980ad)
- **5.x: Upgrading `merge-descriptors` with allowing minors (#5782)** (0b243b1)
- **deps: path-to-regexp@0.1.8 (#5603)** (c5addb9)
- **Merge branch 'ci/v5-node-lts' into 5-merge** (63992bb)
- **Merge branch 'master' into 5-merge** (ea49706)
- **Merge branch '5.0' into 5-merge** (dde1f7d)
- **Ignore `expires` and `maxAge` in `res.clearCookie()` (#5792)** (82fc12a)
- **💚 remove node <11, all failing permanently now** (9c756b0)
- **Use Array.flat instead of array-flatten (#5677)** (d106bf5)
- **Throw on invalid status codes (#4212)** (723b545)
- **Replace Appveyor windows testing with GHA (#5599)** (f4bd86e)
- **Merge branch 'master' into 5.0** (c96c690)
- **remove minor version pinning from ci (#5722)** (4cf7eed)
- **skip QUERY tests for Node 21 only, still not supported (#5695)** (61421a8)
- **[v4] Deprecate `res.clearCookie` accepting `options.maxAge` and `options.expires` (#5672)** (f42b160)
- **✨ bring back query tests for node 21 (#5690)** (689073d)
- **call callback once on listen error** (ee40a88)
- **ignore ETAG query test as well, reuse skip util (#5639)** (b44191e)
- **skip QUERY method test (#5628)** (8417c60)
- **deps: encodeurl@~2.0.0 (#5569)** (bf91946)
- **Use object with null prototype for settings closes #4835** (26801a0)
- **Use object with null prototype for various app properties** (1443973)
- **remove examples from the ignore** (6da57c7)
- **crib fastify's ci concurrency logic** (4771ba2)
- **update ci push trigger only to some branches, ignore examples, .md** (3ae704f)
- **Update Security.md** (8b6d349)
- **Update Security.md** (36b8148)
- **Update Release-Process.md** (6d98d2e)
- **Update Security.md** (4e3f95c)
- **Update Release-Process.md** (88bd6d8)
- **remove duplicate location test for data uri** (94669f9)
- **4.19.2** (b28db2c)

### Docs
- **docs: specify new instructions for `question` and `discuss`** (a3e7e05)
- **docs: add @IamLizu to the triage team (#5836)** (e35380a)
- **docs: update scorecard link (#5814)** (f5b6e67)
- **docs: add OSSF Scorecard badge (#5436)** (2177f67)
- **docs: add @UlisesGascon as captain for cookie-parser (#5666)** (2803a2b)
- **docs: add UlisesGascon as triage initiative captain** (d97d79e)
- **docs: update triage nomination policy (#5600)** (6abec20)
- **docs: update reference to the threat model (#5590)** (815f799)
- **docs: add blakeembrey as captain for encodeurl (#5579)** (93cf646)
- **docs: add reference to the Threat Model** (2676a1f)

### Chore
- **chore: qs@6.13.0 (#5847)** (13e6894)
- **refactor: replace 'path-is-absolute' dep with node:path isAbsolute method (#5830)** (0983158)
- **chore: upgrade `debug` dep from 3.10 to 4.3.6 (#5829)** (41c054c)
- **ci: add CodeQL (SAST) (#5433)** (26e53f0)
- **ci: adopt Node@18 as the minimum supported version** (e9bcdd3)
- **refactor: reword to pre-releases** (51a7636)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/expressjs/express?utm_source=github-action)._