3.19.2

deps: marked@0.3.3
deps: should@~4.6.2
2026-02-26 18:57:43 +00:00 · 2015-02-01 15:15:53 -05:00 · 2015-02-01 14:58:19 -05:00 · 2015-02-01 14:56:18 -05:00 · 2015-02-01 14:55:42 -05:00 · 2015-02-01 14:54:46 -05:00
70 changed files with 1470 additions and 703 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,16 +1,26 @@
-coverage/
-.DS_Store
-*.seed
+# OS X
+.DS_Store*
+Icon?
+._*
+
+# Windows
+Thumbs.db
+ehthumbs.db
+Desktop.ini
+
+# Linux
+.directory
+*~
+
+
+# npm
+node_modules
 *.log
-*.csv
-*.dat
-*.out
-*.pid
-*.swp
-*.swo
+*.gz
+
+
+# Coveralls
+coverage
+
+# Benchmarking
 benchmarks/graphs
-testing
-node_modules/
-testing
-test.js
-.idea
--- a/.npmignore
+++ b/.npmignore
@@ -1,10 +0,0 @@
-.git*
-benchmarks/
-coverage/
-docs/
-examples/
-support/
-test/
-testing.js
-.DS_Store
-.travis.yml
--- a/History.md
+++ b/History.md
@@ -1,3 +1,588 @@
+3.19.2 / 2015-02-01
+===================
+
+  * deps: connect@2.28.3
+    - deps: compression@~1.3.1
+    - deps: csurf@~1.6.6
+    - deps: errorhandler@~1.3.3
+    - deps: express-session@~1.10.2
+    - deps: serve-index@~1.6.1
+    - deps: type-is@~1.5.6
+  * deps: proxy-addr@~1.0.6
+    - deps: ipaddr.js@0.1.8
+
+3.19.1 / 2015-01-20
+===================
+
+  * deps: connect@2.28.2
+    - deps: body-parser@~1.10.2
+    - deps: serve-static@~1.8.1
+  * deps: send@0.11.1
+    - Fix root path disclosure
+
+3.19.0 / 2015-01-09
+===================
+
+  * Fix `OPTIONS` responses to include the `HEAD` method property
+  * Use `readline` for prompt in `express(1)`
+  * deps: commander@2.6.0
+  * deps: connect@2.28.1
+    - deps: body-parser@~1.10.1
+    - deps: compression@~1.3.0
+    - deps: connect-timeout@~1.5.0
+    - deps: csurf@~1.6.4
+    - deps: debug@~2.1.1
+    - deps: errorhandler@~1.3.2
+    - deps: express-session@~1.10.1
+    - deps: finalhandler@0.3.3
+    - deps: method-override@~2.3.1
+    - deps: morgan@~1.5.1
+    - deps: serve-favicon@~2.2.0
+    - deps: serve-index@~1.6.0
+    - deps: serve-static@~1.8.0
+    - deps: type-is@~1.5.5
+  * deps: debug@~2.1.1
+  * deps: methods@~1.1.1
+  * deps: proxy-addr@~1.0.5
+    - deps: ipaddr.js@0.1.6
+  * deps: send@0.11.0
+    - deps: debug@~2.1.1
+    - deps: etag@~1.5.1
+    - deps: ms@0.7.0
+    - deps: on-finished@~2.2.0
+
+3.18.6 / 2014-12-12
+===================
+
+  * Fix exception in `req.fresh`/`req.stale` without response headers
+
+3.18.5 / 2014-12-11
+===================
+
+  * deps: connect@2.27.6
+    - deps: compression@~1.2.2
+    - deps: express-session@~1.9.3
+    - deps: http-errors@~1.2.8
+    - deps: serve-index@~1.5.3
+    - deps: type-is@~1.5.4
+
+3.18.4 / 2014-11-23
+===================
+
+  * deps: connect@2.27.4
+    - deps: body-parser@~1.9.3
+    - deps: compression@~1.2.1
+    - deps: errorhandler@~1.2.3
+    - deps: express-session@~1.9.2
+    - deps: qs@2.3.3
+    - deps: serve-favicon@~2.1.7
+    - deps: serve-static@~1.5.1
+    - deps: type-is@~1.5.3
+  * deps: etag@~1.5.1
+  * deps: proxy-addr@~1.0.4
+    - deps: ipaddr.js@0.1.5
+
+3.18.3 / 2014-11-09
+===================
+
+  * deps: connect@2.27.3
+    - Correctly invoke async callback asynchronously
+    - deps: csurf@~1.6.3
+
+3.18.2 / 2014-10-28
+===================
+
+  * deps: connect@2.27.2
+    - Fix handling of URLs containing `://` in the path
+    - deps: body-parser@~1.9.2
+    - deps: qs@2.3.2
+
+3.18.1 / 2014-10-22
+===================
+
+  * Fix internal `utils.merge` deprecation warnings
+  * deps: connect@2.27.1
+    - deps: body-parser@~1.9.1
+    - deps: express-session@~1.9.1
+    - deps: finalhandler@0.3.2
+    - deps: morgan@~1.4.1
+    - deps: qs@2.3.0
+    - deps: serve-static@~1.7.1
+  * deps: send@0.10.1
+    - deps: on-finished@~2.1.1
+
+3.18.0 / 2014-10-17
+===================
+
+  * Use `content-disposition` module for `res.attachment`/`res.download`
+    - Sends standards-compliant `Content-Disposition` header
+    - Full Unicode support
+  * Use `etag` module to generate `ETag` headers
+  * deps: connect@2.27.0
+    - Use `http-errors` module for creating errors
+    - Use `utils-merge` module for merging objects
+    - deps: body-parser@~1.9.0
+    - deps: compression@~1.2.0
+    - deps: connect-timeout@~1.4.0
+    - deps: debug@~2.1.0
+    - deps: depd@~1.0.0
+    - deps: express-session@~1.9.0
+    - deps: finalhandler@0.3.1
+    - deps: method-override@~2.3.0
+    - deps: morgan@~1.4.0
+    - deps: response-time@~2.2.0
+    - deps: serve-favicon@~2.1.6
+    - deps: serve-index@~1.5.0
+    - deps: serve-static@~1.7.0
+  * deps: debug@~2.1.0
+    - Implement `DEBUG_FD` env variable support
+  * deps: depd@~1.0.0
+  * deps: send@0.10.0
+    - deps: debug@~2.1.0
+    - deps: depd@~1.0.0
+    - deps: etag@~1.5.0
+
+3.17.8 / 2014-10-15
+===================
+
+  * deps: connect@2.26.6
+    - deps: compression@~1.1.2
+    - deps: csurf@~1.6.2
+    - deps: errorhandler@~1.2.2
+
+3.17.7 / 2014-10-08
+===================
+
+  * deps: connect@2.26.5
+    - Fix accepting non-object arguments to `logger`
+    - deps: serve-static@~1.6.4
+
+3.17.6 / 2014-10-02
+===================
+
+  * deps: connect@2.26.4
+    - deps: morgan@~1.3.2
+    - deps: type-is@~1.5.2
+
+3.17.5 / 2014-09-24
+===================
+
+  * deps: connect@2.26.3
+    - deps: body-parser@~1.8.4
+    - deps: serve-favicon@~2.1.5
+    - deps: serve-static@~1.6.3
+  * deps: proxy-addr@~1.0.3
+    - Use `forwarded` npm module
+  * deps: send@0.9.3
+    - deps: etag@~1.4.0
+
+3.17.4 / 2014-09-19
+===================
+
+  * deps: connect@2.26.2
+    - deps: body-parser@~1.8.3
+    - deps: qs@2.2.4
+
+3.17.3 / 2014-09-18
+===================
+
+  * deps: proxy-addr@~1.0.2
+    - Fix a global leak when multiple subnets are trusted
+    - deps: ipaddr.js@0.1.3
+
+3.17.2 / 2014-09-15
+===================
+
+  * Use `crc` instead of `buffer-crc32` for speed
+  * deps: connect@2.26.1
+    - deps: body-parser@~1.8.2
+    - deps: depd@0.4.5
+    - deps: express-session@~1.8.2
+    - deps: morgan@~1.3.1
+    - deps: serve-favicon@~2.1.3
+    - deps: serve-static@~1.6.2
+  * deps: depd@0.4.5
+  * deps: send@0.9.2
+    - deps: depd@0.4.5
+    - deps: etag@~1.3.1
+    - deps: range-parser@~1.0.2
+
+3.17.1 / 2014-09-08
+===================
+
+  * Fix error in `req.subdomains` on empty host
+
+3.17.0 / 2014-09-08
+===================
+
+  * Support IP address host in `req.subdomains`
+  * deps: connect@2.26.0
+    - deps: body-parser@~1.8.1
+    - deps: compression@~1.1.0
+    - deps: connect-timeout@~1.3.0
+    - deps: cookie-parser@~1.3.3
+    - deps: cookie-signature@1.0.5
+    - deps: csurf@~1.6.1
+    - deps: debug@~2.0.0
+    - deps: errorhandler@~1.2.0
+    - deps: express-session@~1.8.1
+    - deps: finalhandler@0.2.0
+    - deps: fresh@0.2.4
+    - deps: media-typer@0.3.0
+    - deps: method-override@~2.2.0
+    - deps: morgan@~1.3.0
+    - deps: qs@2.2.3
+    - deps: serve-favicon@~2.1.3
+    - deps: serve-index@~1.2.1
+    - deps: serve-static@~1.6.1
+    - deps: type-is@~1.5.1
+    - deps: vhost@~3.0.0
+  * deps: cookie-signature@1.0.5
+  * deps: debug@~2.0.0
+  * deps: fresh@0.2.4
+  * deps: media-typer@0.3.0
+    - Throw error when parameter format invalid on parse
+  * deps: range-parser@~1.0.2
+  * deps: send@0.9.1
+    - Add `lastModified` option
+    - Use `etag` to generate `ETag` header
+    - deps: debug@~2.0.0
+    - deps: fresh@0.2.4
+  * deps: vary@~1.0.0
+    - Accept valid `Vary` header string as `field`
+
+3.16.10 / 2014-09-04
+====================
+
+  * deps: connect@2.25.10
+    - deps: serve-static@~1.5.4
+  * deps: send@0.8.5
+    - Fix a path traversal issue when using `root`
+    - Fix malicious path detection for empty string path
+
+3.16.9 / 2014-08-29
+===================
+
+  * deps: connect@2.25.9
+    - deps: body-parser@~1.6.7
+    - deps: qs@2.2.2
+
+3.16.8 / 2014-08-27
+===================
+
+  * deps: connect@2.25.8
+    - deps: body-parser@~1.6.6
+    - deps: csurf@~1.4.1
+    - deps: qs@2.2.0
+
+3.16.7 / 2014-08-18
+===================
+
+  * deps: connect@2.25.7
+    - deps: body-parser@~1.6.5
+    - deps: express-session@~1.7.6
+    - deps: morgan@~1.2.3
+    - deps: serve-static@~1.5.3
+  * deps: send@0.8.3
+    - deps: destroy@1.0.3
+    - deps: on-finished@2.1.0
+
+3.16.6 / 2014-08-14
+===================
+
+  * deps: connect@2.25.6
+    - deps: body-parser@~1.6.4
+    - deps: qs@1.2.2
+    - deps: serve-static@~1.5.2
+  * deps: send@0.8.2
+    - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`
+
+3.16.5 / 2014-08-11
+===================
+
+  * deps: connect@2.25.5
+    - Fix backwards compatibility in `logger`
+
+3.16.4 / 2014-08-10
+===================
+
+  * Fix original URL parsing in `res.location`
+  * deps: connect@2.25.4
+    - Fix `query` middleware breaking with argument
+    - deps: body-parser@~1.6.3
+    - deps: compression@~1.0.11
+    - deps: connect-timeout@~1.2.2
+    - deps: express-session@~1.7.5
+    - deps: method-override@~2.1.3
+    - deps: on-headers@~1.0.0
+    - deps: parseurl@~1.3.0
+    - deps: qs@1.2.1
+    - deps: response-time@~2.0.1
+    - deps: serve-index@~1.1.6
+    - deps: serve-static@~1.5.1
+  * deps: parseurl@~1.3.0
+
+3.16.3 / 2014-08-07
+===================
+
+  * deps: connect@2.25.3
+    - deps: multiparty@3.3.2
+
+3.16.2 / 2014-08-07
+===================
+
+  * deps: connect@2.25.2
+    - deps: body-parser@~1.6.2
+    - deps: qs@1.2.0
+
+3.16.1 / 2014-08-06
+===================
+
+  * deps: connect@2.25.1
+    - deps: body-parser@~1.6.1
+    - deps: qs@1.1.0
+
+3.16.0 / 2014-08-05
+===================
+
+  * deps: connect@2.25.0
+    - deps: body-parser@~1.6.0
+    - deps: compression@~1.0.10
+    - deps: csurf@~1.4.0
+    - deps: express-session@~1.7.4
+    - deps: qs@1.0.2
+    - deps: serve-static@~1.5.0
+  * deps: send@0.8.1
+    - Add `extensions` option
+
+3.15.3 / 2014-08-04
+===================
+
+  * fix `res.sendfile` regression for serving directory index files
+  * deps: connect@2.24.3
+    - deps: serve-index@~1.1.5
+    - deps: serve-static@~1.4.4
+  * deps: send@0.7.4
+    - Fix incorrect 403 on Windows and Node.js 0.11
+    - Fix serving index files without root dir
+
+3.15.2 / 2014-07-27
+===================
+
+  * deps: connect@2.24.2
+    - deps: body-parser@~1.5.2
+    - deps: depd@0.4.4
+    - deps: express-session@~1.7.2
+    - deps: morgan@~1.2.2
+    - deps: serve-static@~1.4.2
+  * deps: depd@0.4.4
+    - Work-around v8 generating empty stack traces
+  * deps: send@0.7.2
+    - deps: depd@0.4.4
+
+3.15.1 / 2014-07-26
+===================
+
+  * deps: connect@2.24.1
+    - deps: body-parser@~1.5.1
+    - deps: depd@0.4.3
+    - deps: express-session@~1.7.1
+    - deps: morgan@~1.2.1
+    - deps: serve-index@~1.1.4
+    - deps: serve-static@~1.4.1
+  * deps: depd@0.4.3
+    - Fix exception when global `Error.stackTraceLimit` is too low
+  * deps: send@0.7.1
+    - deps: depd@0.4.3
+
+3.15.0 / 2014-07-22
+===================
+
+  * Fix `req.protocol` for proxy-direct connections
+  * Pass options from `res.sendfile` to `send`
+  * deps: connect@2.24.0
+    - deps: body-parser@~1.5.0
+    - deps: compression@~1.0.9
+    - deps: connect-timeout@~1.2.1
+    - deps: debug@1.0.4
+    - deps: depd@0.4.2
+    - deps: express-session@~1.7.0
+    - deps: finalhandler@0.1.0
+    - deps: method-override@~2.1.2
+    - deps: morgan@~1.2.0
+    - deps: multiparty@3.3.1
+    - deps: parseurl@~1.2.0
+    - deps: serve-static@~1.4.0
+  * deps: debug@1.0.4
+  * deps: depd@0.4.2
+    - Add `TRACE_DEPRECATION` environment variable
+    - Remove non-standard grey color from color output
+    - Support `--no-deprecation` argument
+    - Support `--trace-deprecation` argument
+  * deps: parseurl@~1.2.0
+    - Cache URLs based on original value
+    - Remove no-longer-needed URL mis-parse work-around
+    - Simplify the "fast-path" `RegExp`
+  * deps: send@0.7.0
+    - Add `dotfiles` option
+    - Cap `maxAge` value to 1 year
+    - deps: debug@1.0.4
+    - deps: depd@0.4.2
+
+3.14.0 / 2014-07-11
+===================
+
+ * add explicit "Rosetta Flash JSONP abuse" protection
+   - previous versions are not vulnerable; this is just explicit protection
+ * deprecate `res.redirect(url, status)` -- use `res.redirect(status, url)` instead
+ * fix `res.send(status, num)` to send `num` as json (not error)
+ * remove unnecessary escaping when `res.jsonp` returns JSON response
+ * deps: basic-auth@1.0.0
+   - support empty password
+   - support empty username
+ * deps: connect@2.23.0
+   - deps: debug@1.0.3
+   - deps: express-session@~1.6.4
+   - deps: method-override@~2.1.0
+   - deps: parseurl@~1.1.3
+   - deps: serve-static@~1.3.1
+  * deps: debug@1.0.3
+    - Add support for multiple wildcards in namespaces
+  * deps: methods@1.1.0
+    - add `CONNECT`
+  * deps: parseurl@~1.1.3
+    - faster parsing of href-only URLs
+
+3.13.0 / 2014-07-03
+===================
+
+ * add deprecation message to `app.configure`
+ * add deprecation message to `req.auth`
+ * use `basic-auth` to parse `Authorization` header
+ * deps: connect@2.22.0
+   - deps: csurf@~1.3.0
+   - deps: express-session@~1.6.1
+   - deps: multiparty@3.3.0
+   - deps: serve-static@~1.3.0
+ * deps: send@0.5.0
+   - Accept string for `maxage` (converted by `ms`)
+   - Include link in default redirect response
+
+3.12.1 / 2014-06-26
+===================
+
+ * deps: connect@2.21.1
+   - deps: cookie-parser@1.3.2
+   - deps: cookie-signature@1.0.4
+   - deps: express-session@~1.5.2
+   - deps: type-is@~1.3.2
+ * deps: cookie-signature@1.0.4
+   - fix for timing attacks
+
+3.12.0 / 2014-06-21
+===================
+
+ * use `media-typer` to alter content-type charset
+ * deps: connect@2.21.0
+   - deprecate `connect(middleware)` -- use `app.use(middleware)` instead
+   - deprecate `connect.createServer()` -- use `connect()` instead
+   - fix `res.setHeader()` patch to work with with get -> append -> set pattern
+   - deps: compression@~1.0.8
+   - deps: errorhandler@~1.1.1
+   - deps: express-session@~1.5.0
+   - deps: serve-index@~1.1.3
+
+3.11.0 / 2014-06-19
+===================
+
+ * deprecate things with `depd` module
+ * deps: buffer-crc32@0.2.3
+ * deps: connect@2.20.2
+   - deprecate `verify` option to `json` -- use `body-parser` npm module instead
+   - deprecate `verify` option to `urlencoded` -- use `body-parser` npm module instead
+   - deprecate things with `depd` module
+   - use `finalhandler` for final response handling
+   - use `media-typer` to parse `content-type` for charset
+   - deps: body-parser@1.4.3
+   - deps: connect-timeout@1.1.1
+   - deps: cookie-parser@1.3.1
+   - deps: csurf@1.2.2
+   - deps: errorhandler@1.1.0
+   - deps: express-session@1.4.0
+   - deps: multiparty@3.2.9
+   - deps: serve-index@1.1.2
+   - deps: type-is@1.3.1
+   - deps: vhost@2.0.0
+
+3.10.5 / 2014-06-11
+===================
+
+ * deps: connect@2.19.6
+   - deps: body-parser@1.3.1
+   - deps: compression@1.0.7
+   - deps: debug@1.0.2
+   - deps: serve-index@1.1.1
+   - deps: serve-static@1.2.3
+ * deps: debug@1.0.2
+ * deps: send@0.4.3
+   - Do not throw un-catchable error on file open race condition
+   - Use `escape-html` for HTML escaping
+   - deps: debug@1.0.2
+   - deps: finished@1.2.2
+   - deps: fresh@0.2.2
+
+3.10.4 / 2014-06-09
+===================
+
+ * deps: connect@2.19.5
+   - fix "event emitter leak" warnings
+   - deps: csurf@1.2.1
+   - deps: debug@1.0.1
+   - deps: serve-static@1.2.2
+   - deps: type-is@1.2.1
+ * deps: debug@1.0.1
+ * deps: send@0.4.2
+   - fix "event emitter leak" warnings
+   - deps: finished@1.2.1
+   - deps: debug@1.0.1
+
+3.10.3 / 2014-06-05
+===================
+
+ * use `vary` module for `res.vary`
+ * deps: connect@2.19.4
+   - deps: errorhandler@1.0.2
+   - deps: method-override@2.0.2
+   - deps: serve-favicon@2.0.1
+ * deps: debug@1.0.0
+
+3.10.2 / 2014-06-03
+===================
+
+ * deps: connect@2.19.3
+   - deps: compression@1.0.6
+
+3.10.1 / 2014-06-03
+===================
+
+ * deps: connect@2.19.2
+   - deps: compression@1.0.4
+ * deps: proxy-addr@1.0.1
+
+3.10.0 / 2014-06-02
+===================
+
+ * deps: connect@2.19.1
+   - deprecate `methodOverride()` -- use `method-override` npm module instead
+   - deps: body-parser@1.3.0
+   - deps: method-override@2.0.1
+   - deps: multiparty@3.2.8
+   - deps: response-time@2.0.0
+   - deps: serve-static@1.2.1
+ * deps: methods@1.0.1
+ * deps: send@0.4.1
+   - Send `max-age` in `Cache-Control` in correct format
+
 3.9.0 / 2014-05-30
 ==================

--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,10 @@

  Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).

-  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express) [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
+  [![NPM version](https://img.shields.io/npm/v/express.svg?style=flat)](https://www.npmjs.org/package/express)
+  [![Build Status](https://img.shields.io/travis/strongloop/express.svg?style=flat)](https://travis-ci.org/strongloop/express)
+  [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg?style=flat)](https://coveralls.io/r/strongloop/express)
+  [![Gratipay](https://img.shields.io/gratipay/dougwilson.svg?style=flat)](https://gratipay.com/dougwilson/)

 ```js
 var express = require('express');
@@ -62,11 +65,11 @@ app.listen(3000);

 ## More Information

-  * [Website and Documentation](http://expressjs.com/) stored at [visionmedia/expressjs.com](https://github.com/visionmedia/expressjs.com)
+  * [Website and Documentation](http://expressjs.com/) stored at [strongloop/expressjs.com](https://github.com/strongloop/expressjs.com)
  * Join #express on freenode
  * [Google Group](http://groups.google.com/group/express-js) for discussion
  * Follow [tjholowaychuk](http://twitter.com/tjholowaychuk) on twitter for updates
-  * Visit the [Wiki](http://github.com/visionmedia/express/wiki)
+  * Visit the [Wiki](http://github.com/strongloop/express/wiki)
  * [Русскоязычная документация](http://jsman.ru/express/)
  * Run express examples [online](https://runnable.com/express)

@@ -74,7 +77,7 @@ app.listen(3000);

 Clone the Express repo, then install the dev dependencies to install all the example / test suite dependencies:

-    $ git clone git://github.com/visionmedia/express.git --depth 1
+    $ git clone git://github.com/strongloop/express.git --depth 1
    $ cd express
    $ npm install

@@ -100,7 +103,7 @@ $ npm test

 ## Contributors

-  https://github.com/visionmedia/express/graphs/contributors
+  https://github.com/strongloop/express/graphs/contributors

 ## License

--- a/bin/express
+++ b/bin/express
@@ -7,6 +7,7 @@
 var program = require('commander')
  , mkdirp = require('mkdirp')
  , pkg = require('../package.json')
+  , readline = require('readline')
  , version = pkg.version
  , os = require('os')
  , fs = require('fs');
@@ -249,7 +250,7 @@ var app = [
    if (empty || program.force) {
      createApplicationAt(path);
    } else {
-      program.confirm('destination is not empty, continue? ', function(ok){
+      confirm('destination is not empty, continue? [y/N] ', function (ok) {
        if (ok) {
          process.stdin.destroy();
          createApplicationAt(path);
@@ -261,6 +262,22 @@ var app = [
  });
 })(path);

+/**
+ * Prompt for confirmation on STDOUT/STDIN
+ */
+
+function confirm(msg, callback) {
+  var rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+
+  rl.question(msg, function (input) {
+    rl.close();
+    callback(/^y|yes|ok|true$/i.test(input));
+  });
+}
+
 /**
 * Create application at the given directory `path`.
 *
@@ -335,7 +352,7 @@ function createApplicationAt(path) {

    // Session support
    app = app.replace('{sess}', program.sessions
-      ? eol + 'app.use(express.cookieParser(\'your secret here\'));' + eol + 'app.use(express.session());'
+      ? eol + 'app.use(express.session({ secret: \'your secret here\' }));'
      : '');

    // Template support
--- a/examples/auth/app.js
+++ b/examples/auth/app.js
@@ -14,9 +14,8 @@ app.set('views', __dirname + '/views');

 // middleware

-app.use(express.bodyParser());
-app.use(express.cookieParser('shhhh, very secret'));
-app.use(express.session());
+app.use(express.urlencoded({ extended: false }));
+app.use(express.session({ secret: 'shhhh, very secret' }));

 // Session-persisted message middleware

--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -8,7 +8,7 @@ var express = require('../../')

 // general config
 app.set('views', __dirname + '/views');
-app.set('view engine', 'jade');
+app.set('view engine', 'ejs');

 // our custom "verbose errors" setting
 // which we can use in the templates
@@ -82,7 +82,7 @@ app.use(function(err, req, res, next){
 // Routes

 app.get('/', function(req, res){
-  res.render('index.jade');
+  res.render('index.ejs');
 });

 app.get('/404', function(req, res, next){
--- a/examples/error-pages/views/404.ejs
+++ b/examples/error-pages/views/404.ejs
@@ -0,0 +1,3 @@
+<% include error_header %>
+<h2>Cannot find <%= url %></h2>
+<% include footer %>
--- a/examples/error-pages/views/404.jade
+++ b/examples/error-pages/views/404.jade
@@ -1,5 +0,0 @@
-
-extends error
-
-block content
-  h2 Cannot find #{url}
--- a/examples/error-pages/views/500.ejs
+++ b/examples/error-pages/views/500.ejs
@@ -0,0 +1,8 @@
+<% include error_header %>
+<h2>Error: <%= error.message %></h2>
+<% if (settings['verbose errors']) { %>
+  <pre><%= error.stack %></pre>
+<% } else { %>
+  <p>An error occurred!</p>
+<% } %>
+<% include footer %>
--- a/examples/error-pages/views/500.jade
+++ b/examples/error-pages/views/500.jade
@@ -1,13 +0,0 @@
-
-// note that we extend a different
-// layout with jade for 4xx & 5xx
-// responses
-
-extends error
-
-block content
-  h1 Error: #{error.message}
-  if settings['verbose errors']
-    pre= error.stack
-  else
-    p An error ocurred!
--- a/examples/error-pages/views/error.jade
+++ b/examples/error-pages/views/error.jade
@@ -1,6 +0,0 @@
-html
-  head 
-    title Error
-  body
-    h1 An error occurred!
-    block content
--- a/examples/error-pages/views/error_header.ejs
+++ b/examples/error-pages/views/error_header.ejs
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Error</title>
+</head>
+
+<body>
+<h1>An error occurred!</h1>
--- a/examples/error-pages/views/footer.ejs
+++ b/examples/error-pages/views/footer.ejs
@@ -0,0 +1,2 @@
+</body>
+</html>
--- a/examples/error-pages/views/index.ejs
+++ b/examples/error-pages/views/index.ejs
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Custom Pages Example</title>
+</head>
+
+<body>
+<h1>My Site</h1>
+<h2>Pages Example</h2>
+
+<ul>
+<li>visit <a href="/500">500</a></li>
+<li>visit <a href="/404">404</a></li>
+<li>visit <a href="/403">403</a></li>
+</ul>
+
+</body>
+</html>
--- a/examples/error-pages/views/index.jade
+++ b/examples/error-pages/views/index.jade
@@ -1,15 +0,0 @@
-
-extends layout
-
-block content
-  h2 Pages Example
-  ul
-    li 
-      | visit 
-      a(href="/500") 500
-    li
-      | visit 
-      a(href="/404") 404
-    li
-      | visit 
-      a(href='/403') 403
--- a/examples/error-pages/views/layout.jade
+++ b/examples/error-pages/views/layout.jade
@@ -1,6 +0,0 @@
-html
-  head 
-    title Custom Pages Example
-  body
-    h1 My Site
-    block content
--- a/examples/mvc/controllers/pet/index.js
+++ b/examples/mvc/controllers/pet/index.js
@@ -1,7 +1,7 @@

 var db = require('../../db');

-exports.engine = 'jade';
+exports.engine = 'ejs';

 exports.before = function(req, res, next){
  var pet = db.pets[req.params.pet_id];
--- a/examples/mvc/controllers/pet/views/edit.ejs
+++ b/examples/mvc/controllers/pet/views/edit.ejs
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="/style.css">
+<title>Edit <%= pet.name %></title>
+</head>
+
+<body>
+<h1><%= pet.name %></h1>
+<form action="/pet/<%= pet.id %>" method="post">
+  <input type="hidden" name="_method" value="put">
+  <label>Name: <input type="text" name="user[name]" value="<%= pet.name %>"></label>
+  <input type="submit" value="Update">
+</form>
+</body>
+</html>
--- a/examples/mvc/controllers/pet/views/edit.jade
+++ b/examples/mvc/controllers/pet/views/edit.jade
@@ -1,7 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-h1= pet.name
-form(action='/pet/#{pet.id}', method='post')
-  input(type='hidden', name='_method', value='put')
-  label Name: 
-    input(type='text', name='user[name]', value=pet.name)
-  input(type='submit', value='Update')
--- a/examples/mvc/controllers/pet/views/show.ejs
+++ b/examples/mvc/controllers/pet/views/show.ejs
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="/style.css">
+<title><%= pet.name %></title>
+</head>
+
+<body>
+<h1><%= pet.name %> <a href="/pet/<%= pet.id %>/edit">edit</a></h1>
+
+<p>You are viewing <%= pet.name %></p>
+</body>
+</html>
--- a/examples/mvc/controllers/pet/views/show.jade
+++ b/examples/mvc/controllers/pet/views/show.jade
@@ -1,6 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-
-h1= pet.name
-  a(href='/pet/#{pet.id}/edit')  edit
-
-p You are viewing #{pet.name}
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -31,11 +31,10 @@ if (!module.parent) app.use(express.logger('dev'));
 app.use(express.static(__dirname + '/public'));

 // session support
-app.use(express.cookieParser('some secret here'));
-app.use(express.session());
+app.use(express.session({ secret: 'some secret here' }));

 // parse request bodies (req.body)
-app.use(express.bodyParser());
+app.use(express.urlencoded({ extended: true }));

 // support _method (PUT in forms etc)
 app.use(express.methodOverride());
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -9,13 +9,8 @@ var app = express();

 app.use(express.logger('dev'));

-// Required by session() middleware
-// pass the secret for signed cookies
-// (required by session())
-app.use(express.cookieParser('keyboard cat'));
-
 // Populates req.session
-app.use(express.session());
+app.use(express.session({ secret: 'keyboard cat' }));

 app.get('/', function(req, res){
  var body = '';
--- a/examples/session/redis.js
+++ b/examples/session/redis.js
@@ -10,13 +10,8 @@ var app = express();

 app.use(express.logger('dev'));

-// Required by session() middleware
-// pass the secret for signed cookies
-// (required by session())
-app.use(express.cookieParser('keyboard cat'));
-
 // Populates req.session
-app.use(express.session({ store: new RedisStore }));
+app.use(express.session({ store: new RedisStore, secret: 'keyboard cat' }));

 app.get('/', function(req, res){
  var body = '';
--- a/examples/view-constructor/github-view.js
+++ b/examples/view-constructor/github-view.js
@@ -35,13 +35,13 @@ function GithubView(name, options){
 GithubView.prototype.render = function(options, fn){
  var self = this;
  var opts = {
-    host: 'rawgithub.com',
-    port: 80,
+    host: 'raw.githubusercontent.com',
+    port: 443,
    path: this.path,
    method: 'GET'
  };

-  http.request(opts, function(res) {
+  https.request(opts, function(res) {
    var buf = '';
    res.setEncoding('utf8');
    res.on('data', function(str){ buf += str });
--- a/examples/view-constructor/index.js
+++ b/examples/view-constructor/index.js
@@ -24,7 +24,7 @@ app.engine('md', function(str, options, fn){
 })

 // pointing to a particular github repo to load files from it
-app.set('views', 'visionmedia/express');
+app.set('views', 'strongloop/express');

 // register a new view constructor
 app.set('view', GithubView);
@@ -37,7 +37,7 @@ app.get('/', function(req, res){
 })

 app.get('/Readme.md', function(req, res){
-  // rendering a view from https://github.com/visionmedia/express/blob/master/Readme.md
+  // rendering a view from https://github.com/strongloop/express/blob/master/Readme.md
  res.render('Readme.md');
 })

--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -73,7 +73,7 @@ var apiKeys = ['foo', 'bar', 'baz'];
 // these two objects will serve as our faux database

 var repos = [
-    { name: 'express', url: 'http://github.com/visionmedia/express' }
+    { name: 'express', url: 'http://github.com/strongloop/express' }
  , { name: 'stylus', url: 'http://github.com/learnboost/stylus' }
  , { name: 'cluster', url: 'http://github.com/learnboost/cluster' }
 ];
--- a/lib/application.js
+++ b/lib/application.js
@@ -11,9 +11,9 @@ var connect = require('connect')
  , compileETag = require('./utils').compileETag
  , compileTrust = require('./utils').compileTrust
  , View = require('./view')
-  , utils = connect.utils
-  , deprecate = require('./utils').deprecate
  , http = require('http');
+var deprecate = require('depd')('express');
+var merge = require('utils-merge');

 /**
 * Application prototype.
@@ -48,10 +48,12 @@ app.defaultConfiguration = function(){
  // default settings
  this.enable('x-powered-by');
  this.set('etag', 'weak');
-  this.set('env', process.env.NODE_ENV || 'development');
+  var env = process.env.NODE_ENV || 'development';
+  this.set('env', env);
  this.set('subdomain offset', 2);
  this.set('trust proxy', false);
-  debug('booting in %s mode', this.get('env'));
+
+  debug('booting in %s mode', env);

  // implicit middleware
  this.use(connect.query());
@@ -86,13 +88,13 @@ app.defaultConfiguration = function(){
  this.set('views', process.cwd() + '/views');
  this.set('jsonp callback name', 'callback');

-  this.configure('development', function(){
+  if (env === 'development') {
    this.set('json spaces', 2);
-  });
+  }

-  this.configure('production', function(){
+  if (env === 'production') {
    this.enable('view cache');
-  });
+  }
 };

 /**
@@ -411,6 +413,9 @@ app.configure = function(env, fn){
  return this;
 };

+app.configure = deprecate.function(app.configure,
+  'app.configure: Check app.get(\'env\') in an if statement');
+
 /**
 * Delegate `.VERB(...)` calls to `router.VERB(...)`.
 */
@@ -448,7 +453,7 @@ app.all = function(path){

 // del -> delete alias

-app.del = deprecate(app.delete, 'app.del: Use app.delete instead');
+app.del = deprecate.function(app.delete, 'app.del: Use app.delete instead');

 /**
 * Render the given view `name` name with `options`
@@ -479,13 +484,15 @@ app.render = function(name, options, fn){
  }

  // merge app.locals
-  utils.merge(opts, this.locals);
+  merge(opts, this.locals);

  // merge options._locals
-  if (options._locals) utils.merge(opts, options._locals);
+  if (options._locals) {
+    merge(opts, options._locals);
+  }

  // merge options
-  utils.merge(opts, options);
+  merge(opts, options);

  // set .cache unless explicitly provided
  opts.cache = null == opts.cache
--- a/lib/express.js
+++ b/lib/express.js
@@ -2,15 +2,15 @@
 * Module dependencies.
 */

-var merge = require('merge-descriptors');
+var deprecate = require('depd')('express');
+var mixin = require('merge-descriptors');
+var merge = require('utils-merge');
 var connect = require('connect')
  , proto = require('./application')
  , Route = require('./router/route')
  , Router = require('./router')
  , req = require('./request')
-  , res = require('./response')
-  , deprecate = require('./utils').deprecate
-  , utils = connect.utils;
+  , res = require('./response');

 /**
 * Expose `createApplication()`.
@@ -33,7 +33,7 @@ exports.mime = connect.mime;

 function createApplication() {
  var app = connect();
-  utils.merge(app, proto);
+  merge(app, proto);
  app.request = { __proto__: req, app: app };
  app.response = { __proto__: res, app: app };
  app.init();
@@ -45,13 +45,13 @@ function createApplication() {
 * for example `express.logger` etc.
 */

-merge(exports, connect.middleware);
+mixin(exports, connect.middleware);

 /**
 * Deprecated createServer().
 */

-exports.createServer = deprecate(createApplication,
+exports.createServer = deprecate.function(createApplication,
  'createServer() is deprecated\n' +
  'express applications no longer inherit from http.Server\n' +
  'please use:\n' +
--- a/lib/request.js
+++ b/lib/request.js
@@ -3,6 +3,8 @@
 * Module dependencies.
 */

+var auth = require('basic-auth');
+var deprecate = require('depd')('express');
 var http = require('http')
  , utils = require('./utils')
  , connect = require('connect')
@@ -11,6 +13,7 @@ var http = require('http')
  , parse = require('parseurl')
  , proxyaddr = require('proxy-addr')
  , mime = connect.mime;
+var isIP = require('net').isIP;

 /**
 * Request prototype.
@@ -339,7 +342,9 @@ req.is = function(type){
 * Return the protocol string "http" or "https"
 * when requested with TLS. When the "trust proxy"
 * setting trusts the socket address, the
- * "X-Forwarded-Proto" header field will be trusted.
+ * "X-Forwarded-Proto" header field will be trusted
+ * and used if present.
+ *
 * If you're running behind a reverse proxy that
 * supplies https for you this may be enabled.
 *
@@ -348,17 +353,18 @@ req.is = function(type){
 */

 req.__defineGetter__('protocol', function(){
+  var proto = this.connection.encrypted
+    ? 'https'
+    : 'http';
  var trust = this.app.get('trust proxy fn');

  if (!trust(this.connection.remoteAddress)) {
-    return this.connection.encrypted
-      ? 'https'
-      : 'http';
+    return proto;
  }

  // Note: X-Forwarded-Proto is normally only ever a
  //       single value, but this is to be safe.
-  var proto = this.get('X-Forwarded-Proto') || 'http';
+  proto = this.get('X-Forwarded-Proto') || proto;
  return proto.split(/\s*,\s*/)[0];
 });

@@ -422,20 +428,13 @@ req.__defineGetter__('ips', function(){
 */

 req.__defineGetter__('auth', function(){
-  // missing
-  var auth = this.get('Authorization');
-  if (!auth) return;
-
-  // malformed
-  var parts = auth.split(' ');
-  if ('basic' != parts[0].toLowerCase()) return;
-  if (!parts[1]) return;
-  auth = parts[1];
+  deprecate('req.auth: Use basic-auth npm module instead');

  // credentials
-  auth = new Buffer(auth, 'base64').toString().match(/^([^:]*):(.*)$/);
-  if (!auth) return;
-  return { username: auth[1], password: auth[2] };
+  var creds = auth(this);
+  if (!creds) return;
+
+  return { username: creds.name, password: creds.pass };
 });

 /**
@@ -454,11 +453,16 @@ req.__defineGetter__('auth', function(){
 */

 req.__defineGetter__('subdomains', function(){
+  var host = this.host;
+
+  if (!host) return [];
+
  var offset = this.app.get('subdomain offset');
-  return (this.host || '')
-    .split('.')
-    .reverse()
-    .slice(offset);
+  var subdomains = !isIP(host)
+    ? host.split('.').reverse()
+    : [host];
+
+  return subdomains.slice(offset);
 });

 /**
@@ -522,7 +526,7 @@ req.__defineGetter__('fresh', function(){

  // 2xx or 304 as per rfc2616 14.26
  if ((s >= 200 && s < 300) || 304 == s) {
-    return fresh(this.headers, this.res._headers);
+    return fresh(this.headers, (this.res._headers || {}));
  }

  return false;
--- a/lib/response.js
+++ b/lib/response.js
@@ -2,15 +2,19 @@
 * Module dependencies.
 */

+var contentDisposition = require('content-disposition');
+var deprecate = require('depd')('express');
+var escapeHtml = require('escape-html');
+var merge = require('utils-merge');
+var parseUrl = require('parseurl');
+var vary = require('vary');
 var http = require('http')
  , path = require('path')
  , connect = require('connect')
-  , utils = connect.utils
  , sign = require('cookie-signature').sign
  , normalizeType = require('./utils').normalizeType
  , normalizeTypes = require('./utils').normalizeTypes
  , setCharset = require('./utils').setCharset
-  , deprecate = require('./utils').deprecate
  , statusCodes = http.STATUS_CODES
  , cookie = require('cookie')
  , send = require('send')
@@ -101,13 +105,15 @@ res.send = function(body){
    }
  }

+  // disambiguate res.send(status) and res.send(status, num)
+  if (typeof body === 'number' && arguments.length === 1) {
+    // res.send(status) will set status message as text string
+    this.get('Content-Type') || this.type('txt');
+    this.statusCode = body;
+    body = http.STATUS_CODES[body];
+  }
+
  switch (typeof body) {
-    // response status
-    case 'number':
-      this.get('Content-Type') || this.type('txt');
-      this.statusCode = body;
-      body = http.STATUS_CODES[body];
-      break;
    // string defaulting to html
    case 'string':
      if (!this.get('Content-Type')) {
@@ -116,6 +122,7 @@ res.send = function(body){
      }
      break;
    case 'boolean':
+    case 'number':
    case 'object':
      if (null == body) {
        body = '';
@@ -194,9 +201,11 @@ res.json = function(obj){
    // res.json(body, status) backwards compat
    if ('number' == typeof arguments[1]) {
      this.statusCode = arguments[1];
-      return 'number' === typeof obj
-        ? jsonNumDeprecated.call(this, obj)
-        : jsonDeprecated.call(this, obj);
+      if (typeof obj === 'number') {
+        deprecate('res.json(obj, status): Use res.json(status, obj) instead');
+      } else {
+        deprecate('res.json(num, status): Use res.status(status).json(num) instead');
+      }
    } else {
      this.statusCode = obj;
      obj = arguments[1];
@@ -216,12 +225,6 @@ res.json = function(obj){
  return this.send(body);
 };

-var jsonDeprecated = deprecate(res.json,
-  'res.json(obj, status): Use res.json(status, obj) instead');
-
-var jsonNumDeprecated = deprecate(res.json,
-  'res.json(num, status): Use res.status(status).json(num) instead');
-
 /**
 * Send JSON response with JSONP callback support.
 *
@@ -244,9 +247,11 @@ res.jsonp = function(obj){
    // res.json(body, status) backwards compat
    if ('number' == typeof arguments[1]) {
      this.statusCode = arguments[1];
-      return 'number' === typeof obj
-        ? jsonpNumDeprecated.call(this, obj)
-        : jsonpDeprecated.call(this, obj);
+      if (typeof obj === 'number') {
+        deprecate('res.jsonp(obj, status): Use res.jsonp(status, obj) instead');
+      } else {
+        deprecate('res.jsonp(num, status): Use res.status(status).jsonp(num) instead');
+      }
    } else {
      this.statusCode = obj;
      obj = arguments[1];
@@ -257,14 +262,15 @@ res.jsonp = function(obj){
  var app = this.app;
  var replacer = app.get('json replacer');
  var spaces = app.get('json spaces');
-  var body = JSON.stringify(obj, replacer, spaces)
-    .replace(/\u2028/g, '\\u2028')
-    .replace(/\u2029/g, '\\u2029');
+  var body = JSON.stringify(obj, replacer, spaces);
  var callback = this.req.query[app.get('jsonp callback name')];

  // content-type
-  this.charset = this.charset || 'utf-8';
-  this.get('Content-Type') || this.set('Content-Type', 'application/json');
+  if (!this.get('Content-Type')) {
+    this.charset = 'utf-8';
+    this.set('X-Content-Type-Options', 'nosniff');
+    this.set('Content-Type', 'application/json');
+  }

  // fixup callback
  if (Array.isArray(callback)) {
@@ -272,21 +278,27 @@ res.jsonp = function(obj){
  }

  // jsonp
-  if (callback && 'string' === typeof callback) {
+  if (typeof callback === 'string' && callback.length !== 0) {
+    this.charset = 'utf-8';
+    this.set('X-Content-Type-Options', 'nosniff');
    this.set('Content-Type', 'text/javascript');
-    var cb = callback.replace(/[^\[\]\w$.]/g, '');
-    body = 'typeof ' + cb + ' === \'function\' && ' + cb + '(' + body + ');';
+
+    // restrict callback charset
+    callback = callback.replace(/[^\[\]\w$.]/g, '');
+
+    // replace chars not allowed in JavaScript that are in JSON
+    body = body
+      .replace(/\u2028/g, '\\u2028')
+      .replace(/\u2029/g, '\\u2029');
+
+    // the /**/ is a specific security mitigation for "Rosetta Flash JSONP abuse"
+    // the typeof check is just to reduce client error noise
+    body = '/**/ typeof ' + callback + ' === \'function\' && ' + callback + '(' + body + ');';
  }

  return this.send(body);
 };

-var jsonpDeprecated = deprecate(res.json,
-  'res.jsonp(obj, status): Use res.jsonp(status, obj) instead');
-
-var jsonpNumDeprecated = deprecate(res.json,
-  'res.jsonp(num, status): Use res.status(status).jsonp(num) instead');
-
 /**
 * Transfer the file at the given `path`.
 *
@@ -298,8 +310,11 @@ var jsonpNumDeprecated = deprecate(res.json,
 *
 * Options:
 *
- *   - `maxAge` defaulting to 0
- *   - `root`   root directory for relative filenames
+ *   - `maxAge`   defaulting to 0
+ *   - `root`     root directory for relative filenames
+ *   - `dotfiles` serve dotfiles, defaulting to false; can be `"allow"` to send them
+ *
+ * Other options are passed along to `send`.
 *
 * Examples:
 *
@@ -375,9 +390,7 @@ res.sendfile = function(path, options, fn){
  }

  // transfer
-  var file = send(req, path);
-  if (options.root) file.root(options.root);
-  file.maxage(options.maxAge || 0);
+  var file = send(req, path, options);
  file.on('error', error);
  file.on('directory', next);
  file.on('stream', stream);
@@ -401,15 +414,17 @@ res.sendfile = function(path, options, fn){
 * @api public
 */

-res.download = function(path, filename, fn){
+res.download = function download(path, filename, fn) {
  // support function as second arg
-  if ('function' == typeof filename) {
+  if (typeof filename === 'function') {
    fn = filename;
    filename = null;
  }

  filename = filename || path;
-  this.set('Content-Disposition', 'attachment; filename="' + basename(filename) + '"');
+
+  this.set('Content-Disposition', contentDisposition(filename));
+
  return this.sendfile(path, fn);
 };

@@ -532,11 +547,13 @@ res.format = function(obj){
 * @api public
 */

-res.attachment = function(filename){
-  if (filename) this.type(extname(filename));
-  this.set('Content-Disposition', filename
-    ? 'attachment; filename="' + basename(filename) + '"'
-    : 'attachment');
+res.attachment = function attachment(filename) {
+  if (filename) {
+    this.type(extname(filename));
+  }
+
+  this.set('Content-Disposition', contentDisposition(filename));
+
  return this;
 };

@@ -596,7 +613,7 @@ res.get = function(field){
 res.clearCookie = function(name, options){
  var opts = { expires: new Date(1), path: '/' };
  return this.cookie(name, '', options
-    ? utils.merge(opts, options)
+    ? merge(opts, options)
    : opts);
 };

@@ -624,7 +641,7 @@ res.clearCookie = function(name, options){
 */

 res.cookie = function(name, val, options){
-  options = utils.merge({}, options);
+  options = merge({}, options);
  var secret = this.req.secret;
  var signed = options.signed;
  if (signed && !secret) throw new Error('connect.cookieParser("secret") required for signed cookies');
@@ -682,7 +699,7 @@ res.location = function(url){
  if (!~url.indexOf('://') && 0 != url.indexOf('//')) {
    // relative to path
    if ('.' == url[0]) {
-      path = req.originalUrl.split('?')[0];
+      path = parseUrl.original(req).pathname;
      path = path + ('/' == path[path.length - 1] ? '' : '/');
      url = resolve(path, url);
      // relative to mount-point
@@ -710,11 +727,8 @@ res.location = function(url){
 *    res.redirect('/foo/bar');
 *    res.redirect('http://example.com');
 *    res.redirect(301, 'http://example.com');
- *    res.redirect('http://example.com', 301);
 *    res.redirect('../login'); // /blog/post/1 -> /blog/login
 *
- * @param {String} url
- * @param {Number} code
 * @api public
 */

@@ -729,6 +743,7 @@ res.redirect = function(url){
      status = url;
      url = arguments[1];
    } else {
+      deprecate('res.redirect(url, status): Use res.redirect(status, url) instead');
      status = arguments[1];
    }
  }
@@ -744,7 +759,7 @@ res.redirect = function(url){
    },

    html: function(){
-      var u = utils.escape(url);
+      var u = escapeHtml(url);
      body = '<p>' + statusCodes[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>';
    },

@@ -769,31 +784,12 @@ res.redirect = function(url){
 */

 res.vary = function(field){
-  var self = this;
-
-  // nothing
+  // checks for back-compat
  if (!field) return this;
+  if (Array.isArray(field) && !field.length) return this;

-  // array
-  if (Array.isArray(field)) {
-    field.forEach(function(field){
-      self.vary(field);
-    });
-    return;
-  }
+  vary(this, field);

-  var vary = this.get('Vary');
-
-  // append
-  if (vary) {
-    vary = vary.split(/ *, */);
-    if (!~vary.indexOf(field)) vary.push(field);
-    this.set('Vary', vary.join(', '));
-    return this;
-  }
-
-  // set
-  this.set('Vary', field);
  return this;
 };

--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -196,17 +196,32 @@ Router.prototype._options = function(req, res, next){
 * @api private
 */

-Router.prototype._optionsFor = function(path){
-  var self = this;
-  return methods.filter(function(method){
-    var routes = self.map[method];
-    if (!routes || 'options' == method) return;
-    for (var i = 0, len = routes.length; i < len; ++i) {
-      if (routes[i].match(path)) return true;
+Router.prototype._optionsFor = function _optionsFor(path) {
+  var options = [];
+
+  for (var i = 0; i < methods.length; i++) {
+    var method = methods[i];
+
+    if (method === 'options') continue;
+
+    var routes = this.map[method];
+
+    // HEAD methods include GET routes
+    if (!routes && method === 'head') {
+      routes = this.map.get;
    }
-  }).map(function(method){
-    return method.toUpperCase();
-  });
+
+    if (!routes) continue;
+
+    for (var j = 0; j < routes.length; j++) {
+      if (routes[j].match(path)) {
+        options.push(method.toUpperCase());
+        break;
+      }
+    }
+  }
+
+  return options.sort();
 };

 /**
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -3,11 +3,10 @@
 * Module dependencies.
 */

-var mime = require('connect').mime
-  , deprecate = require('util').deprecate
-  , proxyaddr = require('proxy-addr')
-  , crc32 = require('buffer-crc32')
-  , crypto = require('crypto');
+var etag = require('etag');
+var mime = require('connect').mime;
+var proxyaddr = require('proxy-addr');
+var typer = require('media-typer');

 /**
 * toString ref.
@@ -15,35 +14,6 @@ var mime = require('connect').mime

 var toString = {}.toString;

-/**
- * Simple detection of charset parameter in content-type
- */
-var charsetRegExp = /;\s*charset\s*=/;
-
-/**
- * Deprecate function, like core `util.deprecate`,
- * but with NODE_ENV and color support.
- *
- * @param {Function} fn
- * @param {String} msg
- * @return {Function}
- * @api private
- */
-
-exports.deprecate = function(fn, msg){
-  if (process.env.NODE_ENV === 'test') return fn;
-
-  // prepend module name
-  msg = 'express: ' + msg;
-
-  if (process.stderr.isTTY) {
-    // colorize
-    msg = '\x1b[31;1m' + msg + '\x1b[0m';
-  }
-
-  return deprecate(fn, msg);
-};
-
 /**
 * Return strong ETag for `body`.
 *
@@ -53,17 +23,12 @@ exports.deprecate = function(fn, msg){
 * @api private
 */

-exports.etag = function etag(body, encoding){
-  if (body.length === 0) {
-    // fast-path empty body
-    return '"1B2M2Y8AsgTpgAmY7PhCfg=="'
-  }
+exports.etag = function (body, encoding) {
+  var buf = !Buffer.isBuffer(body)
+    ? new Buffer(body, encoding)
+    : body;

-  var hash = crypto
-    .createHash('md5')
-    .update(body, encoding)
-    .digest('base64')
-  return '"' + hash + '"'
+  return etag(buf, {weak: false});
 };

 /**
@@ -76,16 +41,11 @@ exports.etag = function etag(body, encoding){
 */

 exports.wetag = function wetag(body, encoding){
-  if (body.length === 0) {
-    // fast-path empty body
-    return 'W/"0-0"'
-  }
+  var buf = !Buffer.isBuffer(body)
+    ? new Buffer(body, encoding)
+    : body;

-  var buf = Buffer.isBuffer(body)
-    ? body
-    : new Buffer(body, encoding)
-  var len = buf.length
-  return 'W/"' + len.toString(16) + '-' + crc32.unsigned(buf) + '"'
+  return etag(buf, {weak: true});
 };

 /**
@@ -322,22 +282,6 @@ function acceptParams(str, index) {
  return ret;
 }

-/**
- * Escape special characters in the given string of html.
- *
- * @param  {String} html
- * @return {String}
- * @api private
- */
-
-exports.escape = function(html) {
-  return String(html)
-    .replace(/&/g, '&amp;')
-    .replace(/"/g, '&quot;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;');
-};
-
 /**
 * Normalize the given path string,
 * returning a regular expression.
@@ -452,21 +396,12 @@ exports.compileTrust = function(val) {
 exports.setCharset = function(type, charset){
  if (!type || !charset) return type;

-  var exists = charsetRegExp.test(type);
+  // parse type
+  var parsed = typer.parse(type);

-  // removing existing charset
-  if (exists) {
-    var parts = type.split(';');
+  // set charset
+  parsed.parameters.charset = charset;

-    for (var i = 1; i < parts.length; i++) {
-      if (charsetRegExp.test(';' + parts[i])) {
-        parts.splice(i, 1);
-        break;
-      }
-    }
-
-    type = parts.join(';');
-  }
-
-  return type + '; charset=' + charset;
+  // format type
+  return typer.format(parsed);
 };
--- a/package.json
+++ b/package.json
@@ -1,38 +1,19 @@
 {
  "name": "express",
  "description": "Sinatra inspired web development framework",
-  "version": "3.9.0",
+  "version": "3.19.2",
  "author": "TJ Holowaychuk <tj@vision-media.ca>",
  "contributors": [
-    {
-      "name": "TJ Holowaychuk",
-      "email": "tj@vision-media.ca"
-    },
-    {
-      "name": "Aaron Heckmann",
-      "email": "aaron.heckmann+github@gmail.com"
-    },
-    {
-      "name": "Ciaran Jessup",
-      "email": "ciaranj@gmail.com"
-    },
-    {
-      "name": "Douglas Christopher Wilson",
-      "email": "doug@somethingdoug.com"
-    },
-    {
-      "name": "Guillermo Rauch",
-      "email": "rauchg@gmail.com"
-    },
-    {
-      "name": "Jonathan Ong",
-      "email": "me@jongleberry.com"
-    },
-    {
-      "name": "Roman Shtylman",
-      "email": "shtylman+expressjs@gmail.com"
-    }
+    "Aaron Heckmann <aaron.heckmann+github@gmail.com>",
+    "Ciaran Jessup <ciaranj@gmail.com>",
+    "Douglas Christopher Wilson <doug@somethingdoug.com>",
+    "Guillermo Rauch <rauchg@gmail.com>",
+    "Jonathan Ong <me@jongleberry.com>",
+    "Roman Shtylman <shtylman+expressjs@gmail.com"
  ],
+  "license": "MIT",
+  "repository": "strongloop/express",
+  "homepage": "http://expressjs.com/",
  "keywords": [
    "express",
    "framework",
@@ -44,34 +25,38 @@
    "app",
    "api"
  ],
-  "repository": "git://github.com/visionmedia/express",
-  "license": "MIT",
  "dependencies": {
-    "buffer-crc32": "0.2.1",
-    "connect": "2.18.0",
-    "commander": "1.3.2",
-    "methods": "1.0.0",
+    "basic-auth": "1.0.0",
+    "connect": "2.28.3",
+    "content-disposition": "0.5.0",
+    "commander": "2.6.0",
+    "cookie-signature": "1.0.5",
+    "debug": "~2.1.1",
+    "depd": "~1.0.0",
+    "escape-html": "1.0.1",
+    "etag": "~1.5.1",
+    "fresh": "0.2.4",
+    "media-typer": "0.3.0",
+    "methods": "~1.1.1",
    "mkdirp": "0.5.0",
-    "parseurl": "1.0.1",
-    "proxy-addr": "1.0.0",
-    "range-parser": "1.0.0",
-    "send": "0.4.0",
+    "parseurl": "~1.3.0",
+    "proxy-addr": "~1.0.6",
+    "range-parser": "~1.0.2",
+    "send": "0.11.1",
+    "utils-merge": "1.0.0",
+    "vary": "~1.0.0",
    "cookie": "0.1.2",
-    "fresh": "0.2.2",
-    "cookie-signature": "1.0.3",
-    "merge-descriptors": "0.0.2",
-    "debug": ">= 0.8.0 < 1"
+    "merge-descriptors": "0.0.2"
  },
  "devDependencies": {
-    "istanbul": "0.2.10",
-    "mocha": "~1.20.0",
-    "should": "~4.0.0",
-    "ejs": "~1.0.0",
-    "jade": "~1.3.1",
-    "hjs": "~0.0.6",
-    "marked": "0.3.2",
-    "connect-redis": "~1.4.5",
-    "supertest": "~0.13.0"
+    "connect-redis": "~1.5.0",
+    "ejs": "2.1.4",
+    "istanbul": "0.3.5",
+    "marked": "0.3.3",
+    "mocha": "~2.1.0",
+    "should": "~4.6.2",
+    "supertest": "~0.15.0",
+    "hjs": "~0.0.6"
  },
  "engines": {
    "node": ">= 0.8.0"
@@ -79,10 +64,18 @@
  "bin": {
    "express": "./bin/express"
  },
+  "files": [
+    "LICENSE",
+    "History.md",
+    "Readme.md",
+    "index.js",
+    "bin/",
+    "lib/"
+  ],
  "scripts": {
-    "prepublish": "npm prune",
    "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/",
    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
  }
 }
--- a/support/app.js
+++ b/support/app.js
@@ -1,66 +0,0 @@
-
-/**
- * Module dependencies.
- */
-
-var express = require('../');
-
-var app = express()
-  , blog = express()
-  , admin = express();
-
-// app.use(express.logger('dev'))
-blog.use('/admin', admin);
-app.use('/blog', blog);
-app.set('views', __dirname + '/views');
-app.set('view engine', 'jade');
-app.locals.self = true;
-
-app.get('/render', function(req, res){
-  res.render('hello');
-});
-
-admin.get('/', function(req, res){
-  res.send('Hello World\n');
-});
-
-blog.get('/', function(req, res){
-  res.send('Hello World\n');
-});
-
-app.get('/', function(req, res){
-  res.send('Hello World\n');
-});
-
-app.get('/json', function(req, res){
-  res.send({ name: 'Tobi', role: 'admin' });
-});
-
-app.get('/json/:n', function(req, res){
-  var n = ~~req.params.n;
-  var arr = [];
-  var obj = { name: 'Tobi', role: 'admin' };
-  while (n--) arr.push(obj);
-  res.send(arr);
-});
-
-function foo(req, res, next) {
-  next();
-}
-
-app.get('/middleware', foo, foo, foo, foo, function(req, res){
-  res.send('Hello World\n');
-});
-
-var n = 100;
-while (n--) {
-  app.get('/foo', foo, foo, function(req, res){
-    
-  });
-}
-
-app.get('/match', function(req, res){
-  res.send('Hello World\n');
-});
-
-app.listen(8000);
--- a/support/docs
+++ b/support/docs
@@ -1,21 +0,0 @@
-#!/usr/bin/env node
-
-var buf = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', function(chunk){
-  buf += chunk;
-}).on('end', function(){
-  var comments = JSON.parse(buf);
-  comments.forEach(function(comment){
-    if (comment.ignore) return;
-    if (comment.isPrivate) return;
-    if (!comment.ctx) return;
-    if (!comment.description.full.indexOf('Module dep')) return;
-    var ctx = comment.ctx;
-    console.log();
-    console.log('# %s', ctx.string);
-    console.log();
-    console.log(comment.description.full.trim().replace(/^/gm, '  '));
-  });
-  console.log();
-}).resume();
--- a/support/views/hello.jade
+++ b/support/views/hello.jade
@@ -1 +0,0 @@
-p Hello
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -33,6 +33,7 @@ describe('mvc', function(){
    it('should update the pet', function(done){
      request(app)
      .put('/pet/3')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
      .send({ pet: { name: 'Boots' } })
      .end(function(err, res){
        if (err) return done(err);
@@ -95,6 +96,7 @@ describe('mvc', function(){
    it('should update the user', function(done){
      request(app)
      .put('/user/1')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
      .send({ user: { name: 'Tobo' }})
      .end(function(err, res){
        if (err) return done(err);
@@ -109,6 +111,7 @@ describe('mvc', function(){
    it('should create a pet for user', function(done){
      request(app)
      .post('/user/2/pet')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
      .send({ pet: { name: 'Snickers' }})
      .expect('Location', '/user/2')
      .expect(302, function(err, res){
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -53,7 +53,7 @@ describe('web-service', function(){
        .get('/api/repos?api-key=foo')
        .expect('Content-Type', 'application/json; charset=utf-8')
        .expect(/"name":"express"/)
-        .expect(/"url":"http:\/\/github.com\/visionmedia\/express"/)
+        .expect(/"url":"http:\/\/github.com\/strongloop\/express"/)
        .expect(200, done)
      })
    })
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -34,6 +34,8 @@ describe('HEAD', function(){
      .get('/tobi')
      .expect(200, function(err, res){
        if (err) return done(err);
+        delete headers.date;
+        delete res.headers.date;
        assert.deepEqual(res.headers, headers);
        done();
      });
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -12,8 +12,8 @@ describe('OPTIONS', function(){

    request(app)
    .options('/users')
-    .expect('GET,PUT')
-    .expect('Allow', 'GET,PUT', done);
+    .expect('GET,HEAD,PUT')
+    .expect('Allow', 'GET,HEAD,PUT', done);
  })

  it('should not respond if the path is not defined', function(done){
@@ -36,8 +36,8 @@ describe('OPTIONS', function(){

    request(app)
    .options('/other')
-    .expect('GET')
-    .expect('Allow', 'GET', done);
+    .expect('GET,HEAD')
+    .expect('Allow', 'GET,HEAD', done);
  })
 })

--- a/test/app.render.js
+++ b/test/app.render.js
@@ -1,14 +1,15 @@

-var express = require('../');
+var express = require('..');
+var tmpl = require('./support/tmpl');

 describe('app', function(){
  describe('.render(name, fn)', function(){
    it('should support absolute paths', function(done){
-      var app = express();
+      var app = createApp();

      app.locals.user = { name: 'tobi' };

-      app.render(__dirname + '/fixtures/user.jade', function(err, str){
+      app.render(__dirname + '/fixtures/user.tmpl', function (err, str) {
        if (err) return done(err);
        str.should.equal('<p>tobi</p>');
        done();
@@ -16,9 +17,9 @@ describe('app', function(){
    })

    it('should support absolute paths with "view engine"', function(done){
-      var app = express();
+      var app = createApp();

-      app.set('view engine', 'jade');
+      app.set('view engine', 'tmpl');
      app.locals.user = { name: 'tobi' };

      app.render(__dirname + '/fixtures/user', function(err, str){
@@ -29,12 +30,12 @@ describe('app', function(){
    })

    it('should expose app.locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
      app.locals.user = { name: 'tobi' };

-      app.render('user.jade', function(err, str){
+      app.render('user.tmpl', function (err, str) {
        if (err) return done(err);
        str.should.equal('<p>tobi</p>');
        done();
@@ -42,12 +43,12 @@ describe('app', function(){
    })

    it('should support index.<engine>', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
-      app.set('view engine', 'jade');
+      app.set('view engine', 'tmpl');

-      app.render('blog/post', function(err, str){
+      app.render('blog/post', function (err, str) {
        if (err) return done(err);
        str.should.equal('<h1>blog post</h1>');
        done();
@@ -77,10 +78,11 @@ describe('app', function(){

    describe('when the file does not exist', function(){
      it('should provide a helpful error', function(done){
-        var app = express();
+        var app = createApp();
+
        app.set('views', __dirname + '/fixtures');
-        app.render('rawr.jade', function(err){
-          err.message.should.equal('Failed to lookup view "rawr.jade" in views directory "' + __dirname + '/fixtures"');
+        app.render('rawr.tmpl', function (err) {
+          err.message.should.equal('Failed to lookup view "rawr.tmpl" in views directory "' + __dirname + '/fixtures"');
          done();
        });
      })
@@ -88,11 +90,11 @@ describe('app', function(){

    describe('when an error occurs', function(){
      it('should invoke the callback', function(done){
-        var app = express();
+        var app = createApp();

        app.set('views', __dirname + '/fixtures');

-        app.render('user.jade', function(err, str){
+        app.render('user.tmpl', function (err, str) {
          // nextTick to prevent cyclic
          process.nextTick(function(){
            err.message.should.match(/Cannot read property 'name' of undefined/);
@@ -104,11 +106,11 @@ describe('app', function(){

    describe('when an extension is given', function(){
      it('should render the template', function(done){
-        var app = express();
+        var app = createApp();

        app.set('views', __dirname + '/fixtures');

-        app.render('email.jade', function(err, str){
+        app.render('email.tmpl', function (err, str) {
          if (err) return done(err);
          str.should.equal('<p>This is an email</p>');
          done();
@@ -118,9 +120,9 @@ describe('app', function(){

    describe('when "view engine" is given', function(){
      it('should render the template', function(done){
-        var app = express();
+        var app = createApp();

-        app.set('view engine', 'jade');
+        app.set('view engine', 'tmpl');
        app.set('views', __dirname + '/fixtures');

        app.render('email', function(err, str){
@@ -219,13 +221,13 @@ describe('app', function(){

  describe('.render(name, options, fn)', function(){
    it('should render the template', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');

      var user = { name: 'tobi' };

-      app.render('user.jade', { user: user }, function(err, str){
+      app.render('user.tmpl', { user: user }, function (err, str) {
        if (err) return done(err);
        str.should.equal('<p>tobi</p>');
        done();
@@ -233,12 +235,12 @@ describe('app', function(){
    })

    it('should expose app.locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
      app.locals.user = { name: 'tobi' };

-      app.render('user.jade', {}, function(err, str){
+      app.render('user.tmpl', {}, function (err, str) {
        if (err) return done(err);
        str.should.equal('<p>tobi</p>');
        done();
@@ -246,13 +248,13 @@ describe('app', function(){
    })

    it('should give precedence to app.render() locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
      app.locals.user = { name: 'tobi' };
      var jane = { name: 'jane' };

-      app.render('user.jade', { user: jane }, function(err, str){
+      app.render('user.tmpl', { user: jane }, function (err, str) {
        if (err) return done(err);
        str.should.equal('<p>jane</p>');
        done();
@@ -292,3 +294,11 @@ describe('app', function(){
    })
  })
 })
+
+function createApp() {
+  var app = express();
+
+  app.engine('.tmpl', tmpl);
+
+  return app;
+}
--- a/test/fixtures/.name
+++ b/test/fixtures/.name
@@ -0,0 +1 @@
+tobi
--- a/test/fixtures/blog/index.html
+++ b/test/fixtures/blog/index.html
@@ -0,0 +1 @@
+<b>index</b>
--- a/test/fixtures/blog/post/index.jade
+++ b/test/fixtures/blog/post/index.jade
@@ -1 +0,0 @@
-h1 blog post
--- a/test/fixtures/blog/post/index.tmpl
+++ b/test/fixtures/blog/post/index.tmpl
@@ -0,0 +1 @@
+<h1>blog post</h1>
--- a/test/fixtures/email.jade
+++ b/test/fixtures/email.jade
@@ -1 +0,0 @@
-p This is an email
--- a/test/fixtures/email.tmpl
+++ b/test/fixtures/email.tmpl
@@ -0,0 +1 @@
+<p>This is an email</p>
--- a/test/fixtures/pet.jade
+++ b/test/fixtures/pet.jade
@@ -1 +0,0 @@
-p #{first} #{last} is a #{species}
--- a/test/fixtures/user.jade
+++ b/test/fixtures/user.jade
@@ -1 +0,0 @@
-p= user.name
--- a/test/fixtures/user.tmpl
+++ b/test/fixtures/user.tmpl
@@ -0,0 +1 @@
+<p>$user.name</p>
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -32,5 +32,18 @@ describe('req', function(){
      .set('If-None-Match', '"12345"')
      .expect(200, 'false', done);
    })
+
+    it('should return false without response headers', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res._headers = null;
+        res.send(req.fresh);
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'false', done);
+    })
  })
 })
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -45,10 +45,9 @@ describe('req', function(){
            res.send(req.ip);
          });

-          request(app)
-          .get('/')
-          .set('X-Forwarded-For', 'client, p1, p2')
-          .expect('127.0.0.1', done);
+          var test = request(app).get('/')
+          test.set('X-Forwarded-For', 'client, p1, p2')
+          test.expect(200, getExpectedClientAddress(test._server), done);
        })
      })
    })
@@ -63,10 +62,19 @@ describe('req', function(){
          res.send(req.ip);
        });

-        request(app)
-        .get('/')
-        .expect('127.0.0.1', done);
+          var test = request(app).get('/')
+          test.expect(200, getExpectedClientAddress(test._server), done);
      })
    })
  })
 })
+
+/**
+ * Get the local client address depending on AF_NET of server
+ */
+
+function getExpectedClientAddress(server) {
+  return server.address().address === '::'
+    ? '::ffff:127.0.0.1'
+    : '127.0.0.1';
+}
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -32,6 +32,21 @@ describe('req', function(){
        .expect('https', done);
      })

+      it('should default to the socket addr if X-Forwarded-Proto not present', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          req.connection.encrypted = true;
+          res.end(req.protocol);
+        });
+
+        request(app)
+        .get('/')
+        .expect('https', done);
+      })
+
      it('should ignore X-Forwarded-Proto if socket addr not trusted', function(done){
        var app = express();

--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -32,5 +32,18 @@ describe('req', function(){
      .set('If-None-Match', '"12345"')
      .expect(200, 'true', done);
    })
+
+    it('should return true without response headers', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res._headers = null;
+        res.send(req.stale);
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'true', done);
+    })
  })
 })
--- a/test/req.subdomains.js
+++ b/test/req.subdomains.js
@@ -15,7 +15,33 @@ describe('req', function(){
        request(app)
        .get('/')
        .set('Host', 'tobi.ferrets.example.com')
-        .expect(["ferrets","tobi"], done);
+        .expect(200, ['ferrets', 'tobi'], done);
+      })
+
+      it('should work with IPv4 address', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.send(req.subdomains);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', '127.0.0.1')
+        .expect(200, [], done);
+      })
+
+      it('should work with IPv6 address', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.send(req.subdomains);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', '[::1]')
+        .expect(200, [], done);
      })
    })

@@ -30,7 +56,7 @@ describe('req', function(){
        request(app)
        .get('/')
        .set('Host', 'example.com')
-        .expect([], done);
+        .expect(200, [], done);
      })
    })

@@ -45,7 +71,23 @@ describe('req', function(){

        request(app)
        .get('/')
-        .expect([], done);
+        .expect(200, [], done);
+      })
+    })
+
+    describe('with trusted X-Forwarded-Host', function () {
+      it('should return an array', function (done) {
+        var app = express();
+
+        app.set('trust proxy', true);
+        app.use(function (req, res) {
+          res.send(req.subdomains);
+        });
+
+        request(app)
+        .get('/')
+        .set('X-Forwarded-Host', 'tobi.ferrets.example.com')
+        .expect(200, ['ferrets', 'tobi'], done);
      })
    })

@@ -62,7 +104,35 @@ describe('req', function(){
          request(app)
          .get('/')
          .set('Host', 'tobi.ferrets.sub.example.com')
-          .expect(["com","example","sub","ferrets","tobi"], done);
+          .expect(200, ['com', 'example', 'sub', 'ferrets', 'tobi'], done);
+        })
+
+        it('should return an array with the whole IPv4', function (done) {
+          var app = express();
+          app.set('subdomain offset', 0);
+
+          app.use(function(req, res){
+            res.send(req.subdomains);
+          });
+
+          request(app)
+          .get('/')
+          .set('Host', '127.0.0.1')
+          .expect(200, ['127.0.0.1'], done);
+        })
+
+        it('should return an array with the whole IPv6', function (done) {
+          var app = express();
+          app.set('subdomain offset', 0);
+
+          app.use(function(req, res){
+            res.send(req.subdomains);
+          });
+
+          request(app)
+          .get('/')
+          .set('Host', '[::1]')
+          .expect(200, ['[::1]'], done);
        })
      })

@@ -78,7 +148,7 @@ describe('req', function(){
          request(app)
          .get('/')
          .set('Host', 'tobi.ferrets.sub.example.com')
-          .expect(["ferrets","tobi"], done);
+          .expect(200, ['ferrets', 'tobi'], done);
        })
      })

@@ -94,7 +164,7 @@ describe('req', function(){
          request(app)
          .get('/')
          .set('Host', 'sub.example.com')
-          .expect([], done);
+          .expect(200, [], done);
        })
      })
    })
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -1,8 +1,8 @@

 var express = require('../')
  , request = require('supertest')
-  , utils = require('connect').utils
  , cookie = require('cookie');
+var merge = require('utils-merge');

 describe('res', function(){
  describe('.cookie(name, object)', function(){
@@ -111,7 +111,7 @@ describe('res', function(){
        var app = express();

        var options = { maxAge: 1000 };
-        var optionsCopy = utils.merge({}, options);
+        var optionsCopy = merge({}, options);

        app.use(function(req, res){
          res.cookie('name', 'tobi', options)
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -81,7 +81,7 @@ describe('res', function(){
      it('should be invoked instead of auto-responding', function(done){
        request(app3)
        .get('/')
-        .set('Accept: text/html')
+        .set('Accept', 'text/html')
        .expect('default', done);
      })
    })
--- a/test/res.get.js
+++ b/test/res.get.js
@@ -1,14 +1,20 @@

-var express = require('../')
-  , res = express.response;
+var express = require('..');
+var request = require('supertest');

 describe('res', function(){
  describe('.get(field)', function(){
-    it('should get the response header field', function(){
-      res.setHeader('Content-Type', 'text/x-foo');
-      res.get('Content-Type').should.equal('text/x-foo');
-      res.get('Content-type').should.equal('text/x-foo');
-      res.get('content-type').should.equal('text/x-foo');
+    it('should get the response header field', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.setHeader('Content-Type', 'text/x-foo');
+        res.send(res.get('Content-Type'));
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'text/x-foo', done);
    })
  })
 })
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -14,11 +14,8 @@ describe('res', function(){

      request(app)
      .get('/?callback=something')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof something === \'function\' && something({"count":1});');
-        done();
-      })
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /something\(\{"count":1\}\);/, done);
    })

    it('should use first callback parameter with jsonp', function(done){
@@ -29,12 +26,9 @@ describe('res', function(){
      });

      request(app)
-          .get('/?callback=something&callback=somethingelse')
-          .end(function(err, res){
-            res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-            res.text.should.equal('typeof something === \'function\' && something({"count":1});');
-            done();
-          })
+      .get('/?callback=something&callback=somethingelse')
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /something\(\{"count":1\}\);/, done);
    })

    it('should ignore object callback parameter with jsonp', function(done){
@@ -61,11 +55,8 @@ describe('res', function(){

      request(app)
      .get('/?clb=something')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof something === \'function\' && something({"count":1});');
-        done();
-      })
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /something\(\{"count":1\}\);/, done);
    })

    it('should allow []', function(done){
@@ -77,11 +68,8 @@ describe('res', function(){

      request(app)
      .get('/?callback=callbacks[123]')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof callbacks[123] === \'function\' && callbacks[123]({"count":1});');
-        done();
-      })
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /callbacks\[123\]\(\{"count":1\}\);/, done);
    })

    it('should disallow arbitrary js', function(done){
@@ -93,11 +81,8 @@ describe('res', function(){

      request(app)
      .get('/?callback=foo;bar()')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof foobar === \'function\' && foobar({});');
-        done();
-      })
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /foobar\(\{\}\);/, done);
    })

    it('should escape utf whitespace', function(done){
@@ -109,13 +94,37 @@ describe('res', function(){

      request(app)
      .get('/?callback=foo')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof foo === \'function\' && foo({"str":"\\u2028 \\u2029 woot"});');
-        done();
-      });
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /foo\(\{"str":"\\u2028 \\u2029 woot"\}\);/, done);
    });

+    it('should not escape utf whitespace for json fallback', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.jsonp({ str: '\u2028 \u2029 woot' });
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(200, '{"str":"\u2028 \u2029 woot"}', done);
+    });
+
+    it('should include security header and prologue', function (done) {
+      var app = express();
+
+      app.use(function(req, res){
+        res.jsonp({ count: 1 });
+      });
+
+      request(app)
+      .get('/?callback=something')
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect('X-Content-Type-Options', 'nosniff')
+      .expect(200, /^\/\*\*\//, done);
+    })
+
    it('should not override previous Content-Types with no callback', function(done){
      var app = express();

@@ -127,7 +136,11 @@ describe('res', function(){
      request(app)
      .get('/')
      .expect('Content-Type', 'application/vnd.example+json; charset=utf-8')
-      .expect(200, '{"hello":"world"}', done);
+      .expect(200, '{"hello":"world"}', function (err, res) {
+        if (err) return done(err);
+        res.headers.should.not.have.property('x-content-type-options');
+        done();
+      });
    })

    it('should override previous Content-Types with callback', function(done){
@@ -141,6 +154,7 @@ describe('res', function(){
      request(app)
      .get('/?callback=cb')
      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect('X-Content-Type-Options', 'nosniff')
      .expect(200, /cb\(\{"hello":"world"\}\);$/, done);
    })

--- a/test/res.links.js
+++ b/test/res.links.js
@@ -1,41 +1,46 @@

-var express = require('../')
-  , res = express.response;
+var express = require('..');
+var request = require('supertest');

 describe('res', function(){
-
-  beforeEach(function() {
-    res.removeHeader('link');
-  });
-
  describe('.links(obj)', function(){
-    it('should set Link header field', function(){
-      res.links({
-        next: 'http://api.example.com/users?page=2',
-        last: 'http://api.example.com/users?page=5'
+    it('should set Link header field', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.links({
+          next: 'http://api.example.com/users?page=2',
+          last: 'http://api.example.com/users?page=5'
+        });
+        res.end();
      });

-      res.get('link')
-      .should.equal(
-          '<http://api.example.com/users?page=2>; rel="next", '
-        + '<http://api.example.com/users?page=5>; rel="last"');
+      request(app)
+      .get('/')
+      .expect('Link', '<http://api.example.com/users?page=2>; rel="next", <http://api.example.com/users?page=5>; rel="last"')
+      .expect(200, done);
    })

-    it('should set Link header field for multiple calls', function() {
-      res.links({
-        next: 'http://api.example.com/users?page=2',
-        last: 'http://api.example.com/users?page=5'
+    it('should set Link header field for multiple calls', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.links({
+          next: 'http://api.example.com/users?page=2',
+          last: 'http://api.example.com/users?page=5'
+        });
+
+        res.links({
+          prev: 'http://api.example.com/users?page=1'
+        });
+
+        res.end();
      });

-      res.links({
-        prev: 'http://api.example.com/users?page=1',
-      });
-
-      res.get('link')
-      .should.equal(
-          '<http://api.example.com/users?page=2>; rel="next", '
-        + '<http://api.example.com/users?page=5>; rel="last", '
-        + '<http://api.example.com/users?page=1>; rel="prev"');
+      request(app)
+      .get('/')
+      .expect('Link', '<http://api.example.com/users?page=2>; rel="next", <http://api.example.com/users?page=5>; rel="last", <http://api.example.com/users?page=1>; rel="prev"')
+      .expect(200, done);
    })
  })
 })
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -1,16 +1,17 @@

-var express = require('../')
-  , request = require('supertest');
+var express = require('..');
+var request = require('supertest');
+var tmpl = require('./support/tmpl');

 describe('res', function(){
  describe('.render(name)', function(){
    it('should support absolute paths', function(done){
-      var app = express();
+      var app = createApp();

      app.locals.user = { name: 'tobi' };

      app.use(function(req, res){
-        res.render(__dirname + '/fixtures/user.jade');
+        res.render(__dirname + '/fixtures/user.tmpl');
      });

      request(app)
@@ -19,10 +20,10 @@ describe('res', function(){
    })

    it('should support absolute paths with "view engine"', function(done){
-      var app = express();
+      var app = createApp();

      app.locals.user = { name: 'tobi' };
-      app.set('view engine', 'jade');
+      app.set('view engine', 'tmpl');

      app.use(function(req, res){
        res.render(__dirname + '/fixtures/user');
@@ -34,13 +35,13 @@ describe('res', function(){
    })

    it('should expose app.locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
      app.locals.user = { name: 'tobi' };

      app.use(function(req, res){
-        res.render('user.jade');
+        res.render('user.tmpl');
      });

      request(app)
@@ -49,10 +50,10 @@ describe('res', function(){
    })
  
    it('should support index.<engine>', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
-      app.set('view engine', 'jade');
+      app.set('view engine', 'tmpl');

      app.use(function(req, res){
        res.render('blog/post');
@@ -65,12 +66,12 @@ describe('res', function(){

    describe('when an error occurs', function(){
      it('should next(err)', function(done){
-        var app = express();
+        var app = createApp();

        app.set('views', __dirname + '/fixtures');

        app.use(function(req, res){
-          res.render('user.jade');
+          res.render('user.tmpl');
        });

        app.use(function(err, req, res, next){
@@ -85,9 +86,9 @@ describe('res', function(){

    describe('when "view engine" is given', function(){
      it('should render the template', function(done){
-        var app = express();
+        var app = createApp();

-        app.set('view engine', 'jade');
+        app.set('view engine', 'tmpl');
        app.set('views', __dirname + '/fixtures');

        app.use(function(req, res){
@@ -103,14 +104,14 @@ describe('res', function(){

  describe('.render(name, option)', function(){
    it('should render the template', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');

      var user = { name: 'tobi' };

      app.use(function(req, res){
-        res.render('user.jade', { user: user });
+        res.render('user.tmpl', { user: user });
      });

      request(app)
@@ -119,13 +120,13 @@ describe('res', function(){
    })

    it('should expose app.locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
      app.locals.user = { name: 'tobi' };

      app.use(function(req, res){
-        res.render('user.jade');
+        res.render('user.tmpl');
      });

      request(app)
@@ -134,13 +135,13 @@ describe('res', function(){
    })

    it('should expose res.locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');

      app.use(function(req, res){
        res.locals.user = { name: 'tobi' };
-        res.render('user.jade');
+        res.render('user.tmpl');
      });

      request(app)
@@ -149,14 +150,14 @@ describe('res', function(){
    })

    it('should give precedence to res.locals over app.locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
      app.locals.user = { name: 'tobi' };

      app.use(function(req, res){
        res.locals.user = { name: 'jane' };
-        res.render('user.jade', {});
+        res.render('user.tmpl', {});
      });

      request(app)
@@ -165,14 +166,14 @@ describe('res', function(){
    })

    it('should give precedence to res.render() locals over res.locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
      var jane = { name: 'jane' };

      app.use(function(req, res){
        res.locals.user = { name: 'tobi' };
-        res.render('user.jade', { user: jane });
+        res.render('user.tmpl', { user: jane });
      });

      request(app)
@@ -181,14 +182,14 @@ describe('res', function(){
    })

    it('should give precedence to res.render() locals over app.locals', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');
      app.locals.user = { name: 'tobi' };
      var jane = { name: 'jane' };

      app.use(function(req, res){
-        res.render('user.jade', { user: jane });
+        res.render('user.tmpl', { user: jane });
      });

      request(app)
@@ -199,13 +200,13 @@ describe('res', function(){

  describe('.render(name, options, fn)', function(){
    it('should pass the resulting string', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');

      app.use(function(req, res){
        var tobi = { name: 'tobi' };
-        res.render('user.jade', { user: tobi }, function(err, html){
+        res.render('user.tmpl', { user: tobi }, function (err, html) {
          html = html.replace('tobi', 'loki');
          res.end(html);
        });
@@ -219,13 +220,13 @@ describe('res', function(){

  describe('.render(name, fn)', function(){
    it('should pass the resulting string', function(done){
-      var app = express();
+      var app = createApp();

      app.set('views', __dirname + '/fixtures');

      app.use(function(req, res){
        res.locals.user = { name: 'tobi' };
-        res.render('user.jade', function(err, html){
+        res.render('user.tmpl', function (err, html) {
          html = html.replace('tobi', 'loki');
          res.end(html);
        });
@@ -238,12 +239,12 @@ describe('res', function(){

    describe('when an error occurs', function(){
      it('should pass it to the callback', function(done){
-        var app = express();
+        var app = createApp();

        app.set('views', __dirname + '/fixtures');

        app.use(function(req, res){
-          res.render('user.jade', function(err){
+          res.render('user.tmpl', function (err) {
            res.end(err.message);
          });
        });
@@ -255,3 +256,11 @@ describe('res', function(){
    })
  })
 })
+
+function createApp() {
+  var app = express();
+
+  app.engine('.tmpl', tmpl);
+
+  return app;
+}
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -77,6 +77,21 @@ describe('res', function(){
    })
  })

+  describe('.send(code, number)', function(){
+    it('should send number as json', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.send(200, 0.123);
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(200, '0.123', done);
+    })
+  })
+
  describe('.send(String)', function(){
    it('should send as html', function(done){
      var app = express();
@@ -105,7 +120,7 @@ describe('res', function(){

      request(app)
      .get('/')
-      .expect('ETag', 'W/"7ff-2796319984"')
+      .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
      .end(done);
    })

@@ -194,7 +209,7 @@ describe('res', function(){

      request(app)
      .get('/')
-      .expect('ETag', 'W/"7ff-2796319984"')
+      .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
      .end(done);
    })

@@ -310,7 +325,7 @@ describe('res', function(){

    request(app)
    .get('/')
-    .set('If-None-Match', 'W/"7ff-2796319984"')
+    .set('If-None-Match', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
    .expect(304, done);
  })

@@ -356,7 +371,7 @@ describe('res', function(){

        request(app)
        .get('/')
-        .expect('etag', 'W/"c-1525560792"', done)
+        .expect('etag', 'W/"c-5aee35d8"', done)
      })

      it('should send ETag for empty string response', function(done){
@@ -385,7 +400,7 @@ describe('res', function(){

        request(app)
        .get('/')
-        .expect('etag', 'W/"7ff-2796319984"', done)
+        .expect('etag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="', done)
      });

      it('should not override ETag when manually set', function(done){
@@ -484,7 +499,7 @@ describe('res', function(){

        request(app)
        .get('/')
-        .expect('etag', 'W/"d-1486392595"', done)
+        .expect('etag', 'W/"d-58988d13"', done)
      })
    })

--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -106,6 +106,54 @@ describe('res', function(){
  })

  describe('.sendfile(path)', function(){
+    it('should not serve dotfiles', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.sendfile('test/fixtures/.name');
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, done);
+    })
+
+    it('should accept dotfiles option', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.sendfile('test/fixtures/.name', { dotfiles: 'allow' });
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'tobi', done);
+    })
+
+    it('should transfer a file', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.sendfile('test/fixtures/name.txt');
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'tobi', done);
+    });
+
+    it('should transfer a directory index file', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.sendfile('test/fixtures/blog/');
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, '<b>index</b>', done);
+    });
+
    describe('with an absolute path', function(){
      it('should transfer the file', function(done){
        var app = express();
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -1,7 +1,6 @@

-var express = require('../')
-  , request = require('supertest')
-  , res = express.response;
+var express = require('..');
+var request = require('supertest');

 describe('res', function(){
  describe('.set(field, value)', function(){
@@ -18,10 +17,18 @@ describe('res', function(){
      .end(done);
    })

-    it('should coerce to a string', function(){
-      res.headers = {};
-      res.set('X-Number', 123);
-      res.get('X-Number').should.equal('123');
+    it('should coerce to a string', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.set('X-Number', 123);
+        res.end(typeof res.get('X-Number'));
+      });
+
+      request(app)
+      .get('/')
+      .expect('X-Number', '123')
+      .expect(200, 'string', done);
    })
  })

@@ -39,11 +46,18 @@ describe('res', function(){
      .expect('["type=ninja","language=javascript"]', done);
    })

-    it('should coerce to an array of strings', function(){
-      res.headers = {};
-      res.set('X-Numbers', [123, 456]);
-      JSON.stringify(res.get('X-Numbers'))
-      .should.equal('["123","456"]');
+    it('should coerce to an array of strings', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.set('X-Numbers', [123, 456]);
+        res.end(JSON.stringify(res.get('X-Numbers')));
+      });
+
+      request(app)
+      .get('/')
+      .expect('X-Numbers', '123, 456')
+      .expect(200, '["123","456"]', done);
    })
  })

@@ -65,10 +79,18 @@ describe('res', function(){
      .end(done);
    })

-    it('should coerce to a string', function(){
-      res.headers = {};
-      res.set({ 'X-Number': 123 });
-      res.get('X-Number').should.equal('123');
+    it('should coerce to a string', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.set({ 'X-Number': 123 });
+        res.end(typeof res.get('X-Number'));
+      });
+
+      request(app)
+      .get('/')
+      .expect('X-Number', '123')
+      .expect(200, 'string', done);
    })
  })
 })
--- a/test/res.vary.js
+++ b/test/res.vary.js
@@ -1,55 +1,96 @@

-var express = require('../')
-  , should = require('should');
-
-function response() {
-  var res = Object.create(express.response);
-  res._headers = {};
-  return res;
-}
+var assert = require('assert');
+var express = require('..');
+var request = require('supertest');

 describe('res.vary()', function(){
  describe('with no arguments', function(){
-    it('should not set Vary', function(){
-      var res = response();
-      res.vary();
-      should.not.exist(res.get('Vary'));
+    it('should not set Vary', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary();
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect(shouldNotHaveHeader('Vary'))
+      .expect(200, done);
    })
  })

  describe('with an empty array', function(){
-    it('should not set Vary', function(){
-      var res = response();
-      res.vary([]);
-      should.not.exist(res.get('Vary'));
+    it('should not set Vary', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary([]);
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect(shouldNotHaveHeader('Vary'))
+      .expect(200, done);
    })
  })

  describe('with an array', function(){
-    it('should set the values', function(){
-      var res = response();
-      res.vary(['Accept', 'Accept-Language', 'Accept-Encoding']);
-      res.get('Vary').should.equal('Accept, Accept-Language, Accept-Encoding');
+    it('should set the values', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary(['Accept', 'Accept-Language', 'Accept-Encoding']);
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('Vary', 'Accept, Accept-Language, Accept-Encoding')
+      .expect(200, done);
    })
  })

  describe('with a string', function(){
-    it('should set the value', function(){
-      var res = response();
-      res.vary('Accept');
-      res.get('Vary').should.equal('Accept');
+    it('should set the value', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary('Accept');
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('Vary', 'Accept')
+      .expect(200, done);
    })
  })

  describe('when the value is present', function(){
-    it('should not add it again', function(){
-      var res = response();
-      res.vary('Accept');
-      res.vary('Accept-Encoding');
-      res.vary('Accept-Encoding');
-      res.vary('Accept-Encoding');
-      res.vary('Accept');
-      res.get('Vary').should.equal('Accept, Accept-Encoding');
+    it('should not add it again', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary('Accept');
+        res.vary('Accept-Encoding');
+        res.vary('Accept-Encoding');
+        res.vary('Accept-Encoding');
+        res.vary('Accept');
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('Vary', 'Accept, Accept-Encoding')
+      .expect(200, done);
    })
  })
 })
+
+function shouldNotHaveHeader(header) {
+  return function (res) {
+    assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
+  };
+}
--- a/test/support/env.js
+++ b/test/support/env.js
@@ -1,2 +1,3 @@

 process.env.NODE_ENV = 'test';
+process.env.NO_DEPRECATION = 'connect,express';
--- a/test/support/tmpl.js
+++ b/test/support/tmpl.js
@@ -0,0 +1,35 @@
+var fs = require('fs');
+
+var variableRegExp = /\$([0-9a-zA-Z\.]+)/g;
+
+module.exports = function renderFile(fileName, options, callback) {
+  function onReadFile(err, str) {
+    if (err) {
+      callback(err);
+      return;
+    }
+
+    try {
+      str = str.replace(variableRegExp, generateVariableLookup(options));
+    } catch (e) {
+      err = e;
+    }
+
+    callback(err, str);
+  }
+
+  fs.readFile(fileName, 'utf8', onReadFile);
+};
+
+function generateVariableLookup(data) {
+  return function variableLookup(str, path) {
+    var parts = path.split('.');
+    var value = data;
+
+    for (var i = 0; i < parts.length; i++) {
+      value = value[parts[i]];
+    }
+
+    return value;
+  };
+}
--- a/test/utils.js
+++ b/test/utils.js
@@ -2,28 +2,6 @@
 var utils = require('../lib/utils')
  , assert = require('assert');

-describe('utils.deprecate(fn, msg)', function(){
-  var env
-  before(function(){
-    env = process.env.NODE_ENV
-  })
-  after(function(){
-    process.env.NODE_ENV = env
-  })
-
-  it('should pass-through fn in test environment', function(){
-    var fn = function(){}
-    process.env.NODE_ENV = 'test'
-    utils.deprecate(fn).should.equal(fn)
-  })
-
-  it('should return new fn in other environment', function(){
-    var fn = function(){}
-    process.env.NODE_ENV = ''
-    utils.deprecate(fn).should.not.equal(fn)
-  })
-})
-
 describe('utils.etag(body, encoding)', function(){
  it('should support strings', function(){
    utils.etag('express!')
@@ -50,18 +28,18 @@ describe('utils.etag(body, encoding)', function(){
 describe('utils.wetag(body, encoding)', function(){
  it('should support strings', function(){
    utils.wetag('express!')
-    .should.eql('W/"8-3098196679"')
+    .should.eql('W/"8-b8aabac7"')
  })

  it('should support utf8 strings', function(){
    utils.wetag('express❤', 'utf8')
-    .should.eql('W/"a-1751845617"')
+    .should.eql('W/"a-686b0af1"')
  })

  it('should support buffer', function(){
    var buf = new Buffer('express!')
    utils.wetag(buf)
-    .should.eql('W/"8-3098196679"');
+    .should.eql('W/"8-b8aabac7"');
  })

  it('should support empty string', function(){
@@ -94,13 +72,6 @@ describe('utils.flatten(arr)', function(){
  })
 })

-describe('utils.escape(html)', function(){
-  it('should escape html entities', function(){
-    utils.escape('<script>foo & "bar"')
-      .should.equal('&lt;script&gt;foo &amp; &quot;bar&quot;')
-  })
-})
-
 describe('utils.parseParams(str)', function(){
  it('should default quality to 1', function(){
    utils.parseParams('text/html')
Author	SHA1	Message	Date
Douglas Christopher Wilson	86328767fe	3.19.2	2015-02-01 15:15:53 -05:00
Douglas Christopher Wilson	e497d068a1	deps: marked@0.3.3	2015-02-01 14:58:19 -05:00
Douglas Christopher Wilson	926a71f5ac	deps: should@~4.6.2	2015-02-01 14:56:18 -05:00
Douglas Christopher Wilson	55f5a2dc8d	deps: proxy-addr@~1.0.6	2015-02-01 14:55:42 -05:00
Douglas Christopher Wilson	fe435e497e	deps: connect@2.28.3	2015-02-01 14:54:46 -05:00
Douglas Christopher Wilson	0c567b3282	3.19.1	2015-01-21 03:18:16 -05:00
Douglas Christopher Wilson	855176b633	tests: remove more mocking uses	2015-01-21 03:17:30 -05:00
Douglas Christopher Wilson	b95f2ee820	deps: should@~4.6.1	2015-01-21 02:14:27 -05:00
Douglas Christopher Wilson	ae92db98f3	deps: ejs@2.1.4	2015-01-21 02:13:17 -05:00
Douglas Christopher Wilson	0b25547ca0	deps: send@0.11.1	2015-01-21 02:05:03 -05:00
Douglas Christopher Wilson	548f2865e2	deps: connect@2.28.2	2015-01-21 02:03:28 -05:00
Douglas Christopher Wilson	ee3f2b073c	3.19.0	2015-01-09 01:07:12 -05:00
Douglas Christopher Wilson	34b6385dc3	deps: debug@~2.1.1	2015-01-09 01:05:41 -05:00
Douglas Christopher Wilson	11529a2ea0	Fix OPTIONS responses to include the HEAD method property fixes #2459	2015-01-08 23:30:42 -05:00
Douglas Christopher Wilson	b0f8809e3d	deps: commander@2.6.0	2015-01-08 22:23:04 -05:00
Douglas Christopher Wilson	ec1175daa3	Use readline for prompt in express(1)	2015-01-08 22:21:50 -05:00
Douglas Christopher Wilson	3a1d9b8289	deps: ejs@2.0.8	2015-01-08 22:17:19 -05:00
Douglas Christopher Wilson	192be8fea3	deps: send@0.11.0	2015-01-08 22:15:53 -05:00
Douglas Christopher Wilson	1afcff955b	deps: proxy-addr@~1.0.5	2015-01-08 22:14:46 -05:00
Douglas Christopher Wilson	224fe05697	deps: methods@~1.1.1	2015-01-08 21:31:32 -05:00
Douglas Christopher Wilson	2dd332b491	deps: mocha@~2.1.0	2015-01-08 21:25:17 -05:00
Douglas Christopher Wilson	33e4193f45	deps: should@~4.4.4	2015-01-08 21:24:28 -05:00
Douglas Christopher Wilson	c163d2f33d	deps: connect@2.28.1	2015-01-08 21:18:56 -05:00
Douglas Christopher Wilson	a715ba6be4	docs: Gittip is now Gratipay	2015-01-08 17:06:08 -05:00
Douglas Christopher Wilson	4405b849a9	3.18.6	2014-12-12 21:39:47 -05:00
Troy Goode	5d74a553d6	Fix exception in req.fresh/req.stale without response headers fixes #2468	2014-12-12 21:17:23 -05:00
Douglas Christopher Wilson	262b60537f	3.18.5	2014-12-11 23:10:34 -05:00
Douglas Christopher Wilson	e77e644224	deps: should@~4.3.1	2014-12-11 23:03:01 -05:00
Douglas Christopher Wilson	ce89c00cd9	deps: istanbul@0.3.5	2014-12-11 23:01:12 -05:00
Douglas Christopher Wilson	d5ad34b0e9	deps: connect@2.27.6	2014-12-10 22:55:36 -05:00
Douglas Christopher Wilson	ebfa00a9c0	build: remove support folder	2014-11-29 12:10:30 -05:00
Douglas Christopher Wilson	d23417e6e8	examples: switch examples used in tests to ejs engine	2014-11-29 12:09:00 -05:00
Douglas Christopher Wilson	91824514ce	tests: run render tests with internal template engine	2014-11-28 09:10:44 -05:00
Douglas Christopher Wilson	6c8bcd5c4e	3.18.4	2014-11-23 15:42:03 -05:00
Douglas Christopher Wilson	95e63ec287	deps: should@~4.3.0	2014-11-23 15:36:59 -05:00
Douglas Christopher Wilson	ebca5887cc	deps: proxy-addr@~1.0.4	2014-11-23 15:34:57 -05:00
Douglas Christopher Wilson	8535d3a990	deps: supertest@~0.15.0	2014-11-23 14:58:56 -05:00
Douglas Christopher Wilson	13184c4379	deps: etag@~1.5.1	2014-11-23 14:58:22 -05:00
Douglas Christopher Wilson	eaba4eeb70	deps: connect@2.27.4	2014-11-23 14:53:23 -05:00
Douglas Christopher Wilson	28c6952d1c	3.18.3	2014-11-09 18:35:34 -05:00
Douglas Christopher Wilson	01e3530a31	deps: should@~4.2.1	2014-11-09 18:33:17 -05:00
Douglas Christopher Wilson	77c83d0c57	deps: connect@2.27.3	2014-11-09 18:32:43 -05:00
Douglas Christopher Wilson	a12ae729bd	3.18.2	2014-10-29 01:10:45 -04:00
Douglas Christopher Wilson	d53a0cd91e	deps: connect@2.27.2	2014-10-29 01:08:36 -04:00
Douglas Christopher Wilson	88dfd36eaa	3.18.1	2014-10-23 01:26:21 -04:00
Douglas Christopher Wilson	5759b3e9f5	deps: send@0.10.1	2014-10-23 01:25:07 -04:00
Douglas Christopher Wilson	c939a771c0	deps: connect@2.27.1	2014-10-23 01:23:54 -04:00
Douglas Christopher Wilson	af1043844f	Fix internal utils.merge deprecation warnings	2014-10-22 15:18:10 -04:00
Douglas Christopher Wilson	dd763ec5b8	deps: should@~4.1.0	2014-10-22 15:10:22 -04:00
Douglas Christopher Wilson	9c2c21aaaf	deps: mocha@~2.0.0	2014-10-22 15:08:49 -04:00
Douglas Christopher Wilson	366000184f	3.18.0	2014-10-18 00:57:48 -04:00
Douglas Christopher Wilson	4d1ee23f84	Use etag module to generate ETag headers	2014-10-18 00:53:17 -04:00
Douglas Christopher Wilson	0e5613363f	Use content-disposition module	2014-10-17 21:08:05 -04:00
Fishrock123	7a7f18c20b	build: misc. updates to packaging closes #2398	2014-10-17 20:49:56 -04:00
Douglas Christopher Wilson	b766aad112	deps: jade@~1.7.0	2014-10-17 20:45:57 -04:00
Douglas Christopher Wilson	7488e27609	deps: send@0.10.0	2014-10-17 20:45:09 -04:00
Douglas Christopher Wilson	bc9d854763	deps: depd@~1.0.0	2014-10-17 20:44:07 -04:00
Douglas Christopher Wilson	2e20a85810	deps: debug@~2.1.0	2014-10-17 20:43:23 -04:00
Douglas Christopher Wilson	a706408208	deps: connect@2.27.0	2014-10-17 20:42:12 -04:00
Douglas Christopher Wilson	6d39d0f8a8	3.17.8	2014-10-16 00:29:56 -04:00
Douglas Christopher Wilson	159ea67713	deps: connect@2.26.6	2014-10-16 00:24:28 -04:00
Douglas Christopher Wilson	33959ed350	deps: mocha@~1.21.5	2014-10-16 00:19:47 -04:00
Bessie Chan	be478d348c	Fix typo in res.redirect deprecation closes #2395	2014-10-11 18:11:22 -04:00
Douglas Christopher Wilson	9f292d873e	3.17.7	2014-10-08 17:00:45 -04:00
Douglas Christopher Wilson	ef3e95ca73	deps: supertest@~0.14.0	2014-10-08 16:44:29 -04:00
Douglas Christopher Wilson	f45bd632df	deps: connect@2.26.5	2014-10-08 16:43:02 -04:00
Douglas Christopher Wilson	cc18da5cdf	3.17.6	2014-10-02 23:29:40 -04:00
Douglas Christopher Wilson	5603f86edd	deps: connect@2.26.4	2014-10-02 23:27:41 -04:00
Douglas Christopher Wilson	43e2cd79cb	3.17.5	2014-09-24 19:38:35 -04:00
Douglas Christopher Wilson	653270bb43	deps: send@0.9.3	2014-09-24 19:15:46 -04:00
Douglas Christopher Wilson	734bdf5ca1	deps: proxy-addr@~1.0.3	2014-09-24 19:14:33 -04:00
Douglas Christopher Wilson	341c1919d9	deps: connect@2.26.3	2014-09-24 19:12:43 -04:00
Douglas Christopher Wilson	b09afad7b1	3.17.4	2014-09-19 22:57:07 -07:00
Douglas Christopher Wilson	0e0b259556	deps: connect@2.26.2	2014-09-19 22:54:39 -07:00
Douglas Christopher Wilson	63286e1192	3.17.3	2014-09-18 10:38:31 -07:00
Douglas Christopher Wilson	c00f2f8596	deps: proxy-addr@~1.0.2	2014-09-18 10:36:21 -07:00
Douglas Christopher Wilson	f29399c4e1	3.17.2	2014-09-16 00:14:41 -07:00
Douglas Christopher Wilson	f6ac068ab0	Use crc instead of buffer-crc32 for speed	2014-09-16 00:11:08 -07:00
Douglas Christopher Wilson	7eb65eeca2	deps: send@0.9.2	2014-09-15 23:59:02 -07:00
Douglas Christopher Wilson	178fe15091	deps: depd@0.4.5	2014-09-15 23:57:41 -07:00
Douglas Christopher Wilson	381f278d0a	deps: connect@2.26.1	2014-09-15 23:56:36 -07:00
Douglas Christopher Wilson	534fa181c6	Add test-tap npm script for TAP output closes #2359	2014-09-15 21:41:35 -07:00
Julien Gilli	80847d8c82	tests: fix broken tests with node v0.12 branch Currently, test/req.ip.js assumes that the connection between the client and the server is an IPv4 connection. However, depending on the configuration of the host where this test runs, the connection can be an IPv4 one or an IPv6 one using an IPv4 mapped address. In the future, it could also be a "full" IPv6 connection. This change makes this test handle any type of address. fixes #2342	2014-09-15 21:41:34 -07:00
Douglas Christopher Wilson	4b1b8e420f	3.17.1	2014-09-08 23:45:38 -04:00
Douglas Christopher Wilson	70767b19ac	Fix error in req.subdomains on empty host	2014-09-08 23:45:34 -04:00
Douglas Christopher Wilson	7d277c1c15	docs: remove erroneous from history	2014-09-08 23:44:24 -04:00
Douglas Christopher Wilson	fa1fcd9fec	3.17.0	2014-09-08 23:07:02 -04:00
Douglas Christopher Wilson	2de6514b4b	Support IP address host in req.subdomains fixes #2308	2014-09-08 23:04:06 -04:00
Douglas Christopher Wilson	d07c06363f	Support X-Forwarded-Host in req.subdomains	2014-09-08 23:02:42 -04:00
Douglas Christopher Wilson	4e97533fd2	deps: jade@~1.6.0	2014-09-08 22:48:47 -04:00
Douglas Christopher Wilson	d7d6219a1e	deps: range-parser@~1.0.2	2014-09-08 22:47:54 -04:00
Douglas Christopher Wilson	9b18461bbc	deps: vary@~1.0.0	2014-09-08 21:18:28 -04:00
Douglas Christopher Wilson	b77aa38c98	deps: cookie-signature@1.0.5	2014-09-08 21:17:03 -04:00
Douglas Christopher Wilson	cbb251377e	deps: fresh@0.2.4	2014-09-08 21:14:27 -04:00
Douglas Christopher Wilson	d6ed469de3	deps: send@0.9.1	2014-09-08 21:13:20 -04:00
Douglas Christopher Wilson	49284c236b	deps: debug@~2.0.0	2014-09-08 21:11:41 -04:00
Douglas Christopher Wilson	be18487f7d	deps: media-typer@0.3.0	2014-09-08 21:10:57 -04:00
Douglas Christopher Wilson	094ff11949	deps: connect@2.26.0	2014-09-08 21:09:22 -04:00
Douglas Christopher Wilson	b97f6eb506	examples: fix github view example closes #2344	2014-09-08 19:31:58 -04:00
Douglas Christopher Wilson	3d188fe13e	3.16.10	2014-09-05 02:17:55 -04:00
Douglas Christopher Wilson	8327708ec2	deps: istanbul@0.3.2	2014-09-05 01:57:02 -04:00
Douglas Christopher Wilson	c8640b3465	deps: send@0.8.5	2014-09-05 01:56:27 -04:00
Douglas Christopher Wilson	3ce5f9b493	deps: connect@2.25.10	2014-09-05 01:55:24 -04:00
Douglas Christopher Wilson	4d032cda05	3.16.9	2014-08-30 01:22:06 -04:00
Douglas Christopher Wilson	4127ba10b0	deps: connect@2.25.9	2014-08-30 01:19:53 -04:00
Douglas Christopher Wilson	0299bee8fa	3.16.8	2014-08-27 21:09:18 -04:00
Douglas Christopher Wilson	6a581c9961	deps: connect@2.25.8	2014-08-27 21:04:41 -04:00
Douglas Christopher Wilson	0b12cc0cac	3.16.7	2014-08-18 22:45:17 -04:00
Douglas Christopher Wilson	fdd0ccabe8	docs: flatten badges for github look	2014-08-18 22:45:13 -04:00
Douglas Christopher Wilson	8c36eab679	docs: use shields.io badges	2014-08-18 22:19:21 -04:00
Douglas Christopher Wilson	5c145b5490	build: add link to homepage	2014-08-18 22:17:25 -04:00
Raymond Feng	d7bef52591	build: move repository closes #2268 closes #2270	2014-08-18 22:07:35 -04:00
Douglas Christopher Wilson	1576a95e87	deps: send@0.8.3	2014-08-18 21:57:29 -04:00
Douglas Christopher Wilson	7f92fe66e0	deps: connect@2.25.7	2014-08-18 21:41:14 -04:00
Douglas Christopher Wilson	f13f4652da	3.16.6	2014-08-14 23:53:32 -04:00
Douglas Christopher Wilson	059c068c7b	deps: send@0.8.2 fixes #2300	2014-08-14 23:52:07 -04:00
Douglas Christopher Wilson	49947f1476	deps: connect@2.25.6	2014-08-14 23:49:39 -04:00
Douglas Christopher Wilson	0dddd772c0	3.16.5	2014-08-11 22:30:09 -04:00
Douglas Christopher Wilson	0f87c6f392	deps: connect@2.25.5	2014-08-11 22:29:35 -04:00
Douglas Christopher Wilson	7119f2b16d	3.16.4	2014-08-10 22:22:58 -04:00
Douglas Christopher Wilson	a57efea173	Fix original URL parsing in res.location	2014-08-10 22:20:54 -04:00
Douglas Christopher Wilson	4a4ca7347a	deps: parseurl@~1.3.0	2014-08-10 22:19:10 -04:00
Douglas Christopher Wilson	570f60d36e	deps: connect@2.25.4	2014-08-10 22:18:12 -04:00
Douglas Christopher Wilson	d13e613584	3.16.3	2014-08-07 22:32:16 -04:00
Douglas Christopher Wilson	9204e1f42a	deps: connect@2.25.3	2014-08-07 22:31:53 -04:00
Douglas Christopher Wilson	ddac571fdf	3.16.2	2014-08-07 11:59:54 -04:00
Douglas Christopher Wilson	982d24b475	deps: connect@2.25.2	2014-08-07 11:53:40 -04:00
Douglas Christopher Wilson	ea427c1bb4	3.16.1	2014-08-06 18:07:31 -04:00
Douglas Christopher Wilson	0bd6c311cf	deps: mocha@~1.21.4	2014-08-06 18:06:19 -04:00
Douglas Christopher Wilson	7f606ebf29	deps: connect@2.25.1	2014-08-06 18:05:50 -04:00
Douglas Christopher Wilson	c652cf7eed	3.16.0	2014-08-06 01:40:46 -04:00
Douglas Christopher Wilson	19fd6f85b0	deps: connect-redis@~1.5.0	2014-08-06 01:39:12 -04:00
Douglas Christopher Wilson	b6c5b0511f	deps: jade@~1.5.0	2014-08-06 01:37:58 -04:00
Douglas Christopher Wilson	0e42a37edd	deps: send@0.8.1	2014-08-06 01:37:13 -04:00
Douglas Christopher Wilson	b24ed15878	deps: connect@2.25.0	2014-08-06 01:35:00 -04:00
Douglas Christopher Wilson	15590d75b2	3.15.3	2014-08-04 17:31:52 -04:00
Douglas Christopher Wilson	e8b471ff4f	fix res.sendfile regression for serving directory index files	2014-08-04 17:30:25 -04:00
Douglas Christopher Wilson	767db01b79	deps: connect@2.24.3	2014-08-04 17:26:43 -04:00
Douglas Christopher Wilson	696e150f0a	3.15.2	2014-07-27 15:53:45 -04:00
Douglas Christopher Wilson	819265c7ae	deps: send@0.7.2	2014-07-27 15:41:54 -04:00
Douglas Christopher Wilson	baf8b14a71	deps: depd@0.4.4 fixes #2262	2014-07-27 15:41:19 -04:00
Douglas Christopher Wilson	06e7685d65	deps: connect@2.24.2	2014-07-27 15:40:19 -04:00
Douglas Christopher Wilson	9f4968aaa3	3.15.1	2014-07-26 17:42:18 -04:00
Douglas Christopher Wilson	afea3c0ae8	deps: mocha@~1.21.0	2014-07-26 17:36:42 -04:00
Douglas Christopher Wilson	edaabe66cf	deps: send@0.7.1	2014-07-26 17:36:40 -04:00
Douglas Christopher Wilson	f724730e1a	Adjust wording on deprecation messages	2014-07-26 17:36:39 -04:00
Douglas Christopher Wilson	e49d0dc9e3	deps: depd@0.4.3 fixes #2262	2014-07-26 17:36:24 -04:00
Douglas Christopher Wilson	e7a3fbaf48	deps: connect@2.24.1	2014-07-26 17:30:13 -04:00
Douglas Christopher Wilson	928952e7f0	3.15.0	2014-07-23 00:53:19 -04:00
Ashley Streb	a28b7a85cf	Fix req.protocol for proxy-direct connections fixes #2252	2014-07-23 00:19:10 -04:00
Douglas Christopher Wilson	3fc8dc54ee	docs: replace Gittip badge	2014-07-23 00:13:21 -04:00
Douglas Christopher Wilson	0d77305a1a	Pass options from res.sendfile to send fixes #2017	2014-07-23 00:08:15 -04:00
Douglas Christopher Wilson	323c185079	deps: send@0.7.0	2014-07-23 00:05:45 -04:00
Douglas Christopher Wilson	1d0da9036b	deps: parseurl@~1.2.0	2014-07-22 23:53:50 -04:00
Douglas Christopher Wilson	683ba1cd75	deps: depd@0.4.2	2014-07-22 23:52:44 -04:00
Douglas Christopher Wilson	e4ff5281c9	deps: connect@2.24.0	2014-07-22 23:50:36 -04:00
Douglas Christopher Wilson	7414a1f463	deps: debug@1.0.4	2014-07-18 14:18:35 -04:00
Douglas Christopher Wilson	916c53737d	3.14.0	2014-07-11 13:11:31 -04:00
Douglas Christopher Wilson	b2382a7336	Remove unnecessary escaping in res.jsonp	2014-07-11 00:20:11 -04:00
Douglas Christopher Wilson	f684a64df7	Add explicit "Rosetta Flash JSONP abuse" protection	2014-07-11 00:15:55 -04:00
Douglas Christopher Wilson	5d03d0eac8	Deprecate res.redirect(url, status)	2014-07-10 23:21:16 -04:00
Yad Smood	544c6665f5	Fix res.send(status, num) to send num as json fixes #2226	2014-07-10 23:19:57 -04:00
Douglas Christopher Wilson	cf8005e63f	deps: basic-auth@1.0.0	2014-07-10 23:07:45 -04:00
Douglas Christopher Wilson	25ef8425d2	deps: methods@1.1.0	2014-07-10 23:06:15 -04:00
Douglas Christopher Wilson	577cc1d1a0	deps: parseurl@~1.1.3	2014-07-10 23:03:26 -04:00
Douglas Christopher Wilson	3c87a6aede	deps: debug@1.0.3	2014-07-10 23:02:24 -04:00
Douglas Christopher Wilson	7c1f90bf16	deps: istanbul@0.3.0	2014-07-10 22:57:08 -04:00
Douglas Christopher Wilson	7bcf5f5085	deps: connect@2.23.0	2014-07-10 22:56:31 -04:00
Douglas Christopher Wilson	abe0ffa311	3.13.0	2014-07-04 00:40:01 -04:00
Douglas Christopher Wilson	b601d64203	tests: fix inconsistent test	2014-07-04 00:38:59 -04:00
Douglas Christopher Wilson	f381f2d9b6	add deprecation message to req.auth	2014-07-04 00:24:01 -04:00
Douglas Christopher Wilson	12507cfcd0	deps: connect@2.22.0	2014-07-03 23:09:44 -04:00
Douglas Christopher Wilson	185e327e29	add deprecation message to app.configure	2014-07-03 14:13:39 -04:00
Douglas Christopher Wilson	c468f5ff20	deps: send@0.5.0	2014-07-03 13:10:33 -04:00
Douglas Christopher Wilson	9bb47fba30	3.12.1	2014-06-26 18:35:54 -04:00
Douglas Christopher Wilson	78d489d730	deps: cookie-signature@1.0.4	2014-06-26 18:26:34 -04:00
Douglas Christopher Wilson	8ffb9f9477	deps: connect@2.21.1	2014-06-26 18:25:48 -04:00
Douglas Christopher Wilson	9cb147370e	deps: istanbul@0.2.12	2014-06-26 18:21:26 -04:00
Douglas Christopher Wilson	75422c16bf	3.12.0	2014-06-21 21:57:02 -04:00
Douglas Christopher Wilson	e66667e465	Use media-typer to alter content-type charset	2014-06-21 21:09:12 -04:00
Douglas Christopher Wilson	7d6208e0af	deps: connect@2.21.0	2014-06-21 21:09:10 -04:00
Douglas Christopher Wilson	2a105df9f2	3.11.0	2014-06-19 23:36:00 -04:00
Douglas Christopher Wilson	9c731f1883	deprecate things with depd module	2014-06-19 23:34:58 -04:00
Douglas Christopher Wilson	5a4e9125de	deps: connect@2.20.2	2014-06-19 23:24:07 -04:00
Douglas Christopher Wilson	9db1367c2d	deps: buffer-crc32@0.2.3	2014-06-19 22:55:21 -04:00
Douglas Christopher Wilson	73c5533e66	3.10.5	2014-06-12 00:28:08 -04:00
Douglas Christopher Wilson	3b1f747f96	deps: send@0.4.3	2014-06-12 00:24:21 -04:00
Douglas Christopher Wilson	9e9827d236	deps: debug@1.0.2	2014-06-12 00:23:15 -04:00
Douglas Christopher Wilson	a76d508424	deps: connect@2.19.6	2014-06-12 00:20:30 -04:00
Douglas Christopher Wilson	f881784e9b	3.10.4	2014-06-09 18:53:52 -04:00
Douglas Christopher Wilson	5af625903f	deps: send@0.4.2	2014-06-09 18:51:55 -04:00
Douglas Christopher Wilson	dc94f305cc	deps: debug@1.0.1	2014-06-09 18:50:36 -04:00
Douglas Christopher Wilson	8060a49c6c	deps: connect@2.19.5	2014-06-09 18:50:00 -04:00
Douglas Christopher Wilson	2fd31f6ea6	3.10.3	2014-06-05 23:38:58 -04:00
Douglas Christopher Wilson	9cf7bba8f0	deps: connect@2.19.4	2014-06-05 23:37:22 -04:00
Douglas Christopher Wilson	2e257d1cf7	build: use compressed formats in package	2014-06-05 19:45:00 -04:00
Douglas Christopher Wilson	56831d7799	deps: debug@1.0.0	2014-06-05 19:34:05 -04:00
Jonathan Ong	6d65ae5ba6	use vary@0.1.0 with backwards compatibility closes #2161	2014-06-05 19:32:32 -04:00
Douglas Christopher Wilson	c919b4a573	3.10.2	2014-06-03 21:35:34 -04:00
Douglas Christopher Wilson	fe6f392c2d	deps: connect@2.19.3	2014-06-03 21:33:55 -04:00
Douglas Christopher Wilson	3b34a537ee	3.10.1	2014-06-03 16:45:09 -04:00
Douglas Christopher Wilson	ad79ce9c4b	deps: connect@2.19.2	2014-06-03 16:44:29 -04:00
Douglas Christopher Wilson	721f6388c3	deps: proxy-addr@1.0.1	2014-06-03 16:42:49 -04:00
Douglas Christopher Wilson	298ac11018	3.10.0	2014-06-03 00:40:27 -04:00
Douglas Christopher Wilson	bb6e207336	deps: connect@2.19.1	2014-06-03 00:37:57 -04:00
Douglas Christopher Wilson	f433b7c7cf	replace utils.escape with html-escape	2014-06-03 00:37:32 -04:00
Douglas Christopher Wilson	a94278abd1	deps: send@0.4.1	2014-06-02 21:31:23 -04:00
Douglas Christopher Wilson	a7cd5a2553	deps: methods@1.0.1	2014-06-02 19:19:56 -04:00