2026-03-02 Express TC Meeting

[github-actions]

Date/Time

Timezone	Date/Time
America/Los_Angeles	Mon, Mar 02, 2026, 11:00 AM
America/Denver	Mon, Mar 02, 2026, 12:00 PM
America/Chicago	Mon, Mar 02, 2026, 01:00 PM
America/Bogota	Mon, Mar 02, 2026, 02:00 PM
America/New_York	Mon, Mar 02, 2026, 02:00 PM
UTC	Mon, Mar 02, 2026, 07:00 PM
Europe/London	Mon, Mar 02, 2026, 07:00 PM
Europe/Madrid	Mon, Mar 02, 2026, 08:00 PM
Europe/Paris	Mon, Mar 02, 2026, 08:00 PM
Europe/Warsaw	Mon, Mar 02, 2026, 08:00 PM
Europe/Moscow	Mon, Mar 02, 2026, 10:00 PM
Asia/Kolkata	Tue, Mar 03, 2026, 12:30 AM
Asia/Shanghai	Tue, Mar 03, 2026, 03:00 AM
Asia/Tokyo	Tue, Mar 03, 2026, 04:00 AM
Australia/Sydney	Tue, Mar 03, 2026, 06:00 AM

Or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=2026-03-02%20Express%20TC%20Meeting&iso=20260302T1900&p1=1440&ah=1

Agenda

Extracted from tc agenda labelled issues and pull requests from expressjs/discussions prior to the meeting.

• New CORS playground #468
• Batch governance changes and present to CPC #466
• Access to Cloudflare Analytics for the Website Captains #465
• Have a Google Search Console account #464
• Use Node.js built-in debug and deprecated utilities instead of relying on external packages. #459
• Proposal: Unify the three GitHub organizations #458
• Create a .github-private repo expressjs #447
• docs: update expressjs.com members and add emeritus section #460
• Rfc for reusable workflows naming repository #455
• Add difference between ADR and RFC #454
• Default workflows part of all repositories #444
• Reusable workflows for npm publish #443
• Create template for RFC #442
• docs: add YesWeHack policy security-wg#90

Invited

• @expressjs/express-tc
• @expressjs/triagers
• @expressjs/security-wg

Observers/Guests

This meeting is open for anyone who wants to attend. Reminder to follow our Code of Conduct.

Joining the meeting

• link for participants: https://zoom-lfx.platform.linuxfoundation.org/meeting/95266714809?password=f37cff1b-cb3a-4a21-9425-210e4714c72e

---

Please use the following emoji reactions in this post to indicate your
availability.

• 👍 - Attending
• 👎 - Not attending
• 😕 - Not sure yet

[jonchurch]

We talked about the value prop for #443 The value here is that we want to bake these workflows, as in we have made some decisions and these exist now. We recommend that captains who are planning to do a release soon, to get in touch with Jean to get the workflow for publish integrated. That way we can get feedback on or iterate on these workflow sbefore we recommend them to the whole org.

We also talked about hwo the Information Architecture of the meta information in Express repo like contribution guide, governance, repo captains, etc is in a sorry state. We rely heavily on the Community Health files, but they are not always very discoverable. Chris brought this up wishing that this information was more dsicoverable and easier to interested folks to drill down into. We are so close to this information its often hard for us to see how difficult it is for others to find, but even for us (me) its often hard to remember where the heck to find these files. (I often have to hunt down the Captains list, even though I know it's somewhere in the Discussions repo)

@jonchurch action item, look into if we can automate a response to private security reports on a repo (aka the Security Reporting github feature). Jean brought up: do we want to be a bit more forward with pointing out to folks that most of our securityy reports get rejected bc they do not meet the bar of our Threat model. Specifically, reports are often closed bc the reporter wrote an insecure application which passes unsanitized input directly into a trusted method, not identified insecure framework code. If most of waht we reject is bc of a specific aspect of our threat model ("most reported issues are bc the thing is not plugged in, please first ensrue it is plugged in"), we should put a blurb INLINE in the response to their report vs only linking out to our wall of text threat model. We absolutely want to direct them to the threat model, but lets promote the most common and immediately relevant information directly in the response. cc @UlisesGascon
Edit: there's no documented API that I can find for posting comments on a security advisory draft 🙃

[jonchurch]

ah edits dont ping, cc @UlisesGascon for the Security Reporting first contact messaging in the above comment