Support for Express 4

[dzcpy]

It would be great to update express to the most current version

[sgress454]

It sure would! Unfortunately it would probably be a breaking change, so it will require lots of testing and fixing. It won't happen for v0.10, but after that we'll evaluate how best to upgrade to Express 4.

[max-degterev]

Hey guys, it's long time since 4.x release. Maybe we should put some time into updating? I wanted to use sails for a serious production app, buts deps are outdated and it kinda concerns me.

[NiroSugir]

What about switching to Koa and making the next version of sails using ES6? Koa will most likely replace Express once Node v0.12 comes out. Thoughts?

[loicsaintroch]

@GeekMode I was thinking about this last week... and I agree with you but it's a pretty huge deal. This is an important decision.

[carloscarcamo]

Would be great to have support for express 4 since strongloop is working on it, express continues its development.

Koa.js is good but I think it will require more work than express.js, and maybe until now is not so mature and well documented as express.js.

For now I will use sails with express.js 3.x but hopefully the core team include express.js 4 in upcoming releases.

And thanks to Sails's core team for their work, is really appreciated :)

[gfaceless]

As this issue has been closed, I wonder if the core team still checks this.

It would be great to update to express 4 for more flexibility and maybe more stability.

[dzcpy]

It would be even cooler if we can choose Koa as an option, with some built-in tools to help with isomorphic rendering. It will be perfect then :)

[JemiloII]

I'm up for express 4 or hapi.js, npm runs on hapi. Whatever base framework we move to, i hope we can add and edit services on the fly. Like while it's running.

[garysui]

Support upgrading to Express 4. Many newer third party software (keycloak for example) are build upon newer Express. Having an old Express making using newer software modules hard.

[damonYuan]

any update for this issue?

[mikermcneil]

@garysui if you're still experiencing compatibility issues, would you mind elaborating in a new issue with some specifics?

It would be great to update to express 4 for more flexibility and maybe more stability.

@gfaceless @damonYuan @JemiloII @carloscarcamo Hey guys, appreciate your feedback. I just clarified the reasoning for our approach here: #3460 (comment)

@andyhu using the dependencies of express 5 directly as discussed at that link ^^ would be an important first step towards this sort of thing. (Koa is possible-- however Hapi would be trickier because of the larger differences between its method names and functionality-- whereas Koa bears many more similarities to Express). In the mean time, if you're a Koa aficionado, you might check out Strapi by @loicsaintroch.

[akmoulai]

@mikermcneil hapi is great to use. It features strong validations (joi) and its architecture is modular. It also is battle-tested; see who's using it (http://hapijs.com/community). After the recent events (I'm averse to politics), I decided to switch from sails to hapi... (it was easy because I was using sails as an api backend). I've looked at Koa; it's great, but it looks like you could use hapi for a lot of stuff and build the MVC on top of it and have something really nice. Sails would be the icing on the hapi cake (if done right).

Just a note to say I'm grateful for sails and it has been a great tool to start using node.

Express 3.x IS NO LONGER MAINTAINED
Known and unknown security and performance issues in 3.x have not been addressed since the last update (1 August, 2015). It is highly recommended to use the latest version of Express.
(source: http://expressjs.com/en/3x/api.html)

I would strongly suggest to switch from Express 3 which may have security issues that are no longer researched nor maintained. To my understanding, security is a feature that a framework should ensure to its best.

Just my 2c, I talk too much and I should probably go back coding.

[mikermcneil]

@devnomad @JemiloII @damonYuan @garysui @gfaceless @carloscarcamo @loicsaintroch @GeekMode @suprMax Posted some more info on this at #3235 (comment).
Let's pick up any other discussion in that thread ^^

Thanks y'all.

[mikermcneil]

@devnomad glad to hear Sails has been helpful for you and best of luck :)

To clarify what's going on w/ Express 3, here's a relevant quote from the discussion in the link above:

[The Sails core team is]... committed to taking ownership over fixing any major security, performance, or stability bugs that arise in Express 3. If anyone reading this has doubts about our commitment to do so, please realize that our core team is running all of our own servers using the latest stable version of Sails in production (like always), and have every reason to make sure Sails and its dependencies are clean and well-oiled.

There's more discussion on why we've made the decisions we have w/ Express 4, what's going on w/ Express 5, and our plans for jshttp/pillar in the linked PR.