JavaScriptv5.2.1

express Dependency Tower

69 dependencies · 126 connections · 1 version tracked

accepts async-function async-generator-function body-parser body-parser bytes call-bind-apply-helpers cal..ound content-disposition content-type@1.0.5 content-type@2.0.0 cookie cookie-signature debug depd dunder-proto ee-first encodeurl es-define-property es-errors escape-html etag express finalhandler finalhandler forwarded fresh function-bind generator-function get-intrinsic get-proto gopd has-symbols hasown http-errors iconv-lite inherits ipaddr.js ipaddr.js is-promise math-intrinsics media-typer merge-descriptors mime-db mime-types ms negotiator negotiator object-inspect object-inspect on-finished once parseurl path-to-regexp proxy-addr qs range-parser raw-body router router router safer-buffer send send serve-static setprototypeof side-channel side-channel-map side-cha..l-weakmap statuses toidentifier type-is unpipe vary wrappy Sep_3_debug_etag Sep_5_side-channel-list_side-channel-weakmap Higher-level content negotiation last commit: 2026-04-02 last release: 2025-03-24 ★ 266 ⚖ MIT A function that returns the normally hidden `AsyncFunction` constructor last commit: 2026-04-21 ★ 5 ⚖ MIT A function that returns the normally hidden `AsyncGeneratorFunction` constructor last commit: 2026-01-13 ⚖ MIT Node.js body parsing middleware last commit: 2026-06-15 last release: 2026-06-15 ★ 5.5k ⚖ MIT node byte string parser ⚠ last commit: 2024-07-05 ★ 475 ⚖ MIT Helper functions around Function call/apply/bind, for use in `call-bind` ⚠ last commit: 2025-02-12 ★ 5 ⚖ MIT Robust call-bound JavaScript intrinsics, using `call-bind` and `get-intrinsic`. ⚠ last commit: 2025-03-03 ★ 6 ⚖ MIT Create and parse HTTP Content-Disposition header last commit: 2026-06-01 last release: 2026-05-28 ★ 244 ⚖ MIT Create and parse HTTP Content-Type header last commit: 2026-06-01 last release: 2026-05-11 ★ 143 ⚖ MIT Create and parse HTTP Content-Type header last commit: 2026-06-01 last release: 2026-05-11 ★ 143 ⚖ MIT HTTP server cookie parsing and serialization last commit: 2026-06-24 last release: 2026-06-24 ★ 1.5k ⚖ MIT cookie signing ⚠ last commit: 2025-04-30 ★ 193 ⚖ MIT A tiny JavaScript debugging utility modelled after Node.js core's debugging technique. Works in Node.js and web browsers last commit: 2026-04-01 last release: 2025-09-13 ★ 11.4k ⚖ MIT Deprecate all the things ⚠ last commit: 2024-09-03 ⚠ last release: 2018-10-26 ★ 329 ⚖ MIT If available, the `Object.prototype.__proto__` accessor and mutator, call-bound. ⚠ last commit: 2024-12-17 ★ 1 ⚖ MIT return the first event in a set of ee/event pairs ⚠ last commit: 2019-04-27 ★ 54 ⚖ MIT Encode a URL to a percent-encoded form, excluding already-encoded sequences last commit: 2026-01-03 last release: 2024-03-29 ★ 39 ⚖ MIT `Object.defineProperty`, but not IE 8's broken one. ⚠ last commit: 2024-12-06 ★ 4 ⚖ MIT A simple cache for a few of the JS Error constructors. ⚠ last commit: 2024-03-09 ★ 10 ⚖ MIT ES Object-related atoms: Object, ToObject, RequireObjectCoercible last commit: 2026-06-16 ★ 5 ⚖ MIT Escape string for use in HTML ⚠ last commit: 2022-09-16 ★ 490 ⚖ MIT Create simple HTTP ETags last commit: 2026-03-01 last release: 2017-09-13 ★ 266 ⚖ MIT Fast, unopinionated, minimalist web framework for node. last commit: 2026-06-16 last release: 2025-12-01 ★ 69.3k ⚖ MIT Node.js final http responder last commit: 2026-06-02 last release: 2025-12-01 ★ 232 ⚖ MIT Parse HTTP X-Forwarded-For header last commit: 2026-06-01 last release: 2021-05-31 ★ 61 ⚖ MIT HTTP request freshness testing last commit: 2026-06-23 ★ 163 ⚖ MIT Implementation of Function.prototype.bind ⚠ last commit: 2023-10-12 ★ 139 ⚖ MIT Expose the GeneratorFunction constructor if supported by the runtime last commit: 2025-09-30 ★ 2 ⚖ MIT Get and robustly cache all JS language-level intrinsics at first require time. last commit: 2026-01-13 ★ 34 ⚖ MIT Robustly get the [[Prototype]] of an object. Uses the best available method. last commit: 2026-01-13 ★ 3 ⚖ MIT `Object.getOwnPropertyDescriptor`, but accounts for IE's broken implementation. last commit: 2026-04-20 ★ 2 ⚖ MIT Determine if the JS environment has Symbol support. Supports spec, or shams. last commit: 2026-04-29 ★ 18 ⚖ MIT A robust, ES3 compatible, "has own property" predicate. last commit: 2026-05-29 ★ 2 ⚖ MIT Create HTTP Errors last commit: 2026-06-01 last release: 2025-11-20 ★ 1.6k ⚖ MIT Convert character encodings in pure javascript. last commit: 2026-05-01 last release: 2026-01-08 ★ 3.2k ⚖ MIT Easy simple tiny inheritance in JavaScript last commit: 2025-10-25 ★ 353 ⚖ BlueOak-1.0.0 · unknown IP address manipulation library in JavaScript last commit: 2026-06-20 ★ 639 ⚖ MIT Test whether an object looks like a promises-a+ promise ⚠ last commit: 2023-04-29 ⚠ last release: 2020-04-27 ★ 282 ⚖ MIT ES Math-related intrinsics and helpers, robustly cached. ⚠ last commit: 2024-12-19 ★ 2 ⚖ MIT Simple RFC 6838 media type parser and formatter last commit: 2026-06-01 last release: 2026-05-27 ★ 59 ⚖ MIT Merge objects using their property descriptors ⚠ last commit: 2023-12-21 ⚠ last release: 2023-11-16 ★ 157 ⚖ MIT Media Type Database last commit: 2026-06-21 last release: 2025-03-18 ★ 1.2k ⚖ MIT The ultimate javascript content-type utility. last commit: 2026-06-02 last release: 2025-11-20 ★ 1.5k ⚖ MIT Tiny millisecond conversion utility last commit: 2026-05-20 last release: 2020-12-08 ★ 5.5k ⚖ MIT An HTTP content negotiator for Node.js last commit: 2026-05-01 last release: 2024-10-19 ★ 383 ⚖ MIT string representations of objects in node and the browser last commit: 2026-04-26 last release: 2021-05-08 ★ 161 ⚖ MIT Execute a callback when a request closes, finishes, or errors last commit: 2026-05-20 last release: 2022-02-22 ★ 404 ⚖ MIT Run a function exactly one time last commit: 2025-10-25 ★ 225 ⚖ BlueOak-1.0.0 · unknown parse a url with memoization last commit: 2026-03-01 ★ 188 ⚖ MIT Turn a path string such as `/user/:name` into a regular expression last commit: 2026-06-24 last release: 2026-04-01 ★ 8.6k ⚖ MIT Determine address of proxied request last commit: 2026-06-01 last release: 2021-06-01 ★ 140 ⚖ MIT A querystring parser and serializer with nesting support last commit: 2026-06-24 ★ 8.9k ⚖ BSD-3-Clause Range header field parser last commit: 2026-02-02 ★ 96 ⚖ MIT Get and validate the raw body of a readable stream last commit: 2026-03-01 last release: 2025-11-21 ★ 400 ⚖ MIT Simple middleware-style router last commit: 2026-06-02 last release: 2025-03-27 ★ 448 ⚖ MIT Modern Buffer API polyfill without footguns ⚠ last commit: 2021-04-22 ⚠ last release: 2018-04-08 ★ 27 ⚖ MIT Streaming static file server with Range and conditional-GET support last commit: 2026-06-01 last release: 2025-12-15 ★ 811 ⚖ MIT Serve static files last commit: 2026-01-03 last release: 2025-12-15 ★ 1.4k ⚖ MIT Polyfill for Object.setPrototypeOf ⚠ last commit: 2022-06-24 ★ 53 ⚖ ISC Store information about any JS value in a side channel. Uses WeakMap if available. last commit: 2026-06-08 ★ 18 ⚖ MIT Store information about any JS value in a side channel, using a linked list. last commit: 2026-04-08 ★ 3 ⚖ MIT Store information about any JS value in a side channel, using a Map. last commit: 2025-12-30 ★ 1 ⚖ MIT Store information about any JS value in a side channel, using a WeakMap for objects and a Map for primitives. last commit: 2025-12-30 ★ 1 ⚖ MIT HTTP status utility last commit: 2026-01-03 last release: 2025-06-06 ★ 285 ⚖ MIT Convert a string of words to a JavaScript identifier ⚠ last commit: 2023-12-18 ★ 6 ⚖ MIT Infer the content-type of a request. last commit: 2026-05-13 last release: 2026-05-13 ★ 230 ⚖ MIT Unpipe a stream from all destinations ⚠ last commit: 2020-12-15 ★ 22 ⚖ MIT Manipulate the HTTP Vary header last commit: 2026-04-02 last release: 2017-09-24 ★ 65 ⚖ MIT Callback wrapping utility ⚠ last commit: 2024-02-10 ★ 56 ⚖ ISC stacktower.io
Dependencies

69

Connections

126

Vulnerabilities

0

License Risks

2

About this dependency tree

express (JavaScript, v5.2.1) has a dependency tree of 69 packages connected by 126 dependency edges. Of these, approximately 65 are transitive dependencies — pulled in indirectly through other packages.

The heaviest direct dependency is body-parser, which brings in 42 transitive packages (62% of the total tree).

No known vulnerabilities or restrictive licenses were detected in this dependency tree.

Security Overview

License Risks

2 packages with non-permissive or unknown licenses

Unknown (2)

  • inherits
  • once

Brittle Dependencies

19 unmaintained or at-risk packages

  • bytes(low activity or limited maintainers)via body-parser
  • call-bind-apply-helpers(low activity or limited maintainers)via qs
  • call-bound(low activity or limited maintainers)via qs
  • cookie-signature(low activity or limited maintainers)
  • depd(low activity or limited maintainers)

Heaviest Dependencies

Direct DependencyTransitive Deps% of Total
body-parser4261.8%
qs2130.9%
serve-static1927.9%

Version History

VersionDepsRenderedCompare
693mo agocurrent

Share & Embed

https://app.stacktower.io/package/javascript/express
[![Dependencies](https://api.stacktower.io/v1/badge/4e606d94-c466-4f37-9b7c-825a00509915)](https://app.stacktower.io/package/javascript/express)

Cookie Preferences

We use essential cookies for authentication. We also use analytics cookies to understand how you use Stacktower and improve the experience. Read our Privacy Policy.