Skip to content
Jonathan Ong edited this page Oct 26, 2013 · 12 revisions

Expected to be released after node v0.12 is released so we can drop node v0.8 support (support 2 latest versions). Deprecation warnings have been added to give developers time to migrate, specifically when using connect through express to avoid a major version bump. Please feel free to add any alternatives to removed middleware.

Note that if you're currently using connect.bodyParser(), you will still get the deprecation warning for multipart. For now, you can ignore it since you should only see the warning message once at start up. If you want to avoid any warning messages, do this instead (which is what connect.bodyParser() will be in 3.0):

app.use(connect.urlencoded())
app.use(connect.json())

Backwards Compatibility Changes

  • Remove multipart middleware. By default, multipart downloads files to disk, which is deemed a security issue. Using multipart middleware as a stream (defer) became overly complex, and maintainers would rather have developers use a multipart parser directly. Since removing the defer option and only allowing developers to download multipart files to disk would cause security concerns, we opted to remove the entire multipart middleware instead. Use one of the following parsers or middleware instead:
  • Remove staticCache. Use one of the following alternatives:
  • Remove limit middleware. No longer used by any of the parsers. It doesn't work properly for streams2.
  • Remove node 0.8 support. Connect 3 will be released after node v0.12 and will only support the latest 2 stable versions of node.

Tentative Changes

  • Cookies - switch to jed/cookies and jed/keygrip.
  • Cookie Sessions - extract into a separate module, use sane defaults as middleware.
  • Sessions - extract into a separate module, use sane defaults as middleware.
  • CSRF - integrate into sessions more
Clone this wiki locally