[Proposal] Upgrading express 3 to 4

[csim-sg]

As express 3 is considered depreciated from ExpressJS website. Are there plans to update the version?

[mikermcneil]

Our approach is that we accept responsibility for our core dependencies-- so if there are problems that affect your usage in Sails, we'll address them and provide a workaround. Rather than upgrading to Express 4, we're interested in using the lower-level modules like Doug Wilson is doing for Express 5. This is covered in more detail in our roadmap.

[udanpe]

So we will need wait expressjs 5 release? You will update sails to expresjs 5 or no? All new module all new features always write only for new version. Expressjs is core. Codeigniter don't want updates to php5 and where he now?

[mikermcneil]

@udanpe are there any user land features or changes you require from this upgrade?

[sgress454]

For a longer discussion of this, see #3235 (comment)

It's easy to overstate the relevance of the Express dependency to Sails, which uses it mainly as a router. I've yet to hear about a specific feature or third-party module that you couldn't use with Sails because the Express version was too old.

[udanpe]

Josebaseba was right. Or you write hooks for use sails with express 4 or change express for other core or sails will be dead.
As long as the version of Express we're using meets that standard, we're not that inclined to upgrade - Its not ruby way

[mikermcneil]

@udanpe I'm sorry, I think all the different posts have made this kind of confusing. To be clear, I am not against this kind of an upgrade-- however I don't agree that we should upgrade for no reason. I really appreciate @Josebaba's work, and I wish we could have communicated about it beforehand to evaluate the approach that @dougwilson and I discussed.

First of all, I'll reiterate: until we hear about any userland features or changes necessitated by a real-world use case from a Sails user, we cannot upgrade a dependency. Despite it seeming like a good idea, it can be dangerous, risky, and irresponsible to change dependencies just for the sake of a version number-- I've learned that the hard way over the past four years of maintaining this framework.

You will update sails to expresjs 5 or no?

We will upgrade to Express 5 or share the same relevant lower-level dependencies used by Express 5, since it will mean a tangible gain in the experience of working with Sails apps: lighter core dependencies, faster installs, and the flexibility to much more easily configure Sails (e.g. disable serving of static web assets, only serving static web assets, only using Socket.io, omitting Socket.io... etc.)

It also makes it easier to do something which is very important to me: provide a lighter version of Sails core and allow you to make custom builds that include only those dependencies which you are actually using. One of the challenges of being a full-featured framework is providing the ability to customize what your app uses and what it doesn't. As you probably already know, you can disable almost anything in Sails today: but you still have to install it. And that sucks! I want to fix it. But upgrading to Express 4 is a step in the opposite direction.

I hope that helps explain where I'm coming from here. Apologies for not spending the time to shed more light before. I really appreciate your patience.

In the mean time, if there are problems, incompatibilities in our documentation, or other issues I'm missing here that would be solved by an upgrade to Express 4, please open an issue to let us know.

[shamasis]

@mikermcneil +1 - I agree on not upgrading for the sake of version number

[udanpe]

I understand what you mean but... For example. I create project and use passportjs. Now its work but after 1 month passport will updates (express 3 is deprecated) so new passport support only 4 version. After 2 month we have security bug in old version passportjs or change oauth or something else. Why is fault passport or sails?

[mikermcneil]

@udanpe is there a security bug you're experiencing currently? If so, please let us know immediately and we'll address it.

[mikermcneil]

Actually, I think I may have misunderstood you- sorry. Do you mean that @jaredhanson is planning on making Passport no longer work with Express 3?

[udanpe]

I don't know what will happen in future. I Want sleep free of worry. I don't use sails now but i see this project sometimes. If you update all dependence, write new features, change site design i think you will have more users. Now project doesn't look seriously. Maybe it's only my mind. I afraid to use the older dependency and don't want every day rewrite projects

[mikermcneil]

@monkeymon Posted some more info on this at #3235 (comment).

Let's pick up any other discussion in that thread (going to lock this issue so that we funnel all future discussion into that PR so it's easier to track)