jonchurch

Express documentation security audit

AI Use Disclosure: The content in this audit was generated by Claude Fable 5.1 at the behest of, and spot checked by, me @jonchurch (Jon Church), a TC member of Express and a "Captain" of the expressjs.com website.

I referenced this information, and my human familiarity with our website and security reports, to drive the decisions I made when proposing the changes to make as part of the Sovereign Tech Agency contract to improve our security documentation.

Audit artifact for Milestone 8 (Documentation to help the community build more secure Express applications), deliverable 1 of 3: Audit: review and evaluate documentation, particularly relating to security areas. Linked from the proposal (deliverable 2).

Snapshot

jonchurch

const downloadCounts = require('download-counts');

const entries = Object.entries(downloadCounts);
console.log(`Total packages in dataset: ${entries.length.toLocaleString()}\n`);

// Count packages at various download thresholds
const thresholds = [
  1_000_000,
  5_000_000,
  10_000_000,

jonchurch

{
  "id": 8040275,
  "name": "Default branch protection",
  "target": "branch",
  "source_type": "Organization",
  "source": "expressjs",
  "enforcement": "active",
  "conditions": {
    "ref_name": {
      "exclude": [],

jonchurch

/**
 * DBCS Edge Case Testing: iconv-lite vs TextDecoder vs WHATWG Spec
 *
 * References:
 * - https://encoding.spec.whatwg.org/#shift_jis-decoder
 * - https://encoding.spec.whatwg.org/#big5-decoder
 * - https://encoding.spec.whatwg.org/#gbk-decoder
 * - https://encoding.spec.whatwg.org/#euc-kr-decoder
 */

jonchurch

Building Lodash Documentation HTML

Steps

# 1. Switch to Node 11
nvm use 11

# 2. Install dependencies (if not done yet)
npm install

jonchurch

Lodash Package Download Stats

Main lodash package: 319.8M/month (80M/wk)

Total lodash.foo packages: 2.6B/month (649M/wk)

Grand Total (lodash + lodash.foo): 2.9B/month (728.9M/wk)

Table of Contents

jonchurch

SELECT DISTINCT Dependent.Name AS package_name, Dependent.Version AS pkg_version
FROM `bigquery-public-data.deps_dev_v1.DependentsLatest`
WHERE System = 'NPM'
  AND Name = 'tape'
  AND Version LIKE '4.%'               -- resolved to tape 4.x
  AND MinimumDepth = 1                 -- direct dependents only
  AND DependentIsHighestReleaseWithResolution;  -- latest release of each dependent

jonchurch

-- Largest single semver component seen for npm packages
WITH parsed AS (
  SELECT
    Name,
    Version,
    SAFE_CAST(REGEXP_EXTRACT(Version, r'^(\d+)') AS INT64) AS major,
    SAFE_CAST(REGEXP_EXTRACT(Version, r'^\d+\.(\d+)') AS INT64) AS minor,
    SAFE_CAST(REGEXP_EXTRACT(Version, r'^\d+\.\d+\.(\d+)') AS INT64) AS patch
  FROM `bigquery-public-data.deps_dev_v1.PackageVersionsLatest`
  WHERE System = 'NPM'

jonchurch

flowchart LR
    %% Configuration for better alignment
    linkStyle default interpolate basis

    FAB_MATS["<div style='padding:8px;min-width:140px;text-align:right;' class='node-container '><div class='node-title' style='text-align:center !important;font-size:0.9em;'>FAB_MATS</div><div class='node-details' style='text-align:right !important;'><div style='text-align:right !important;'><span class='supply-abundant'>ABUNDANT</span> · <span class='activity-restricted'>RESTRICTED</span></div><div style='text-align:right !important;'>1,170c · v:20</div><div style='text-align:right !important;'>X1-RX40-F49</div></div><div style='text-align:right !important;'>RX40</div></div>"]
    class FAB_MATS activity-restricted
    class FAB_MATS export-item

    IRON["<div style='padding:8px;min-width:140px;text-align:right;' class='node-container '><div class='node-title' style='text-align:center !important;font-size:0.9em;'>IRON</div><div class='node-details' style='text-align:right !important;'><div style='text

jonchurch

ABNF/HTTP Syntax Cheatsheet

Basic ABNF Operators

Operator	Meaning
=	Defines a rule. Example: rule-name = value
/	Logical OR (choice). Example: A / B means "A or B".
*	Zero or more occurrences. Example: *DIGIT means "0 or more DIGITs".
1*	One or more occurrences. Example: 1*DIGIT means "1 or more DIGITs".
[ ]	Optional (zero or one occurrence). Example: [DIGIT] means "optional DIGIT".