Merge branch 'main' into blog/may-2026-security-releases

Author: UlisesGascon

.editorconfig

@@ -0,0 +1,19 @@
+# EditorConfig: https://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+indent_style = space
+indent_size = 2
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab

.github/CODEOWNERS

@@ -4,5 +4,6 @@
 # Codeowners
 .github/CODEOWNERS @expressjs/docs-captains
 
-# Blog
-_posts @expressjs/express-tc
+# Blog - TODO: Add once Astro blog structure is set up
+
+src/content/blog @expressjs/express-tc

.github/dependabot.yml

@@ -4,22 +4,54 @@ updates:
     directory: /
     schedule:
       interval: monthly
-
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: monthly
-
-  - package-ecosystem: bundler
-    directory: /
-    schedule:
-      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - '*'
 
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: monthly
     open-pull-requests-limit: 10
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
+    groups:
+      astro:
+        patterns:
+          - '@astrojs/*'
+          - 'astro'
+          - 'astro-*'
+          - 'prettier-plugin-astro'
+      orama:
+        patterns:
+          - '@orama/*'
+          - 'gray-matter'
+          - 'mdast-util-from-markdown'
+          - 'mdast-util-to-string'
+      linters:
+        patterns:
+          - 'eslint'
+          - 'eslint-*'
+          - '@eslint/*'
+          - 'prettier'
+          - 'typescript-eslint'
+          - 'globals'
+      production:
+        dependency-type: production
+        exclude-patterns:
+          - '@astrojs/*'
+          - 'astro'
+          - 'astro-*'
+          - '@orama/*'
+          - 'gray-matter'
+          - 'mdast-util-from-markdown'
+          - 'mdast-util-to-string'
+      development:
+        dependency-type: development
+        exclude-patterns:
+          - 'eslint'
+          - 'eslint-*'
+          - '@eslint/*'
+          - 'prettier'
+          - 'prettier-plugin-astro'
+          - 'typescript-eslint'
+          - 'globals'

.github/scripts/get-contributing.sh

@@ -1,92 +1,92 @@
 #!/bin/bash
 
-# This script replaces the contents of a section with the contents from the annotated source address or local file paths inside the DEST file.
+# This script replaces the contents of a section with the contents from the
+# annotated source address (SRC comments) inside the DEST file.
+# SRC comments use the format: {/* SRC: org/repo path/to/file */}
 
-# read contents of file into memory
-DEST="../../en/resources/contributing.md"
+DEST="../../src/content/pages/en/resources/contributing.mdx"
+
+# Shared content transformations
+transform_content() {
+  local content="$1"
+  local level="$2"
+
+  # Keep only from first ## onward (skip title/badges)
+  content=$(echo "$content" | sed -En '/^##|^[^#]/,$p')
+
+  # Downgrade headings based on parent level
+  content=$(echo "$content" | sed 's/^#/&'"${level:1}"'/g')
+
+  # Convert GitHub callouts to Alert components
+  content=$(echo "$content" | perl -0777 -pe '
+    s/> \[!(IMPORTANT|NOTE|TIP|CAUTION|WARNING)\]\s*\n((?:>.*\n)*)/
+      my $type = lc($1);
+      my %map = (important => "info", note => "info", tip => "info", caution => "warning", warning => "warning");
+      my $alert = $map{$type} || "info";
+      my $body = $2;
+      $body =~ s|^> ?||gm;
+      "<Alert type=\"$alert\">\n\n${body}\n<\/Alert>\n"
+    /ge')
+
+  # Convert HTML comments to MDX comments
+  content=$(echo "$content" | sed -E 's/<!--(.*)-->/\{\/\*\1\*\/\}/g')
+
+  # Convert self-closing HTML tags for MDX compatibility
+  content=$(echo "$content" | sed -E 's/<(br|hr|img)([^/]*[^/])?\s*>/<\1\2 \/>/gi')
+
+  echo "$content"
+}
 
-# track the header level 
 level=''
-# tracks src for curl calls
 src=''
-# tracks file paths for local file reads
-local=''
-  while IFS= read -r line; do
-  # REMOVE PREVIOUS CONTENT SECTION
-  # if src or local tags are not empty
-  if [[ -n "$src" || -n "$local" ]]; then
-    #  if current line not a horitzontal rule hr
-    if  [[ "$line" != "----"* ]]; then
-    #  if line == level -- level is num of ##
-      if [[ "$line" == "$level"'#'*  ||
-      # line not a header line
-      "$line" != '#'* ]]; then
-        # skip line and rewrite over old content
-          continue
+
+while IFS= read -r line; do
+  # Skip lines from previous SRC section (will be replaced)
+  if [[ -n "$src" ]]; then
+    if [[ "$line" != "----"* ]]; then
+      if [[ "$line" == "$level"'#'* || "$line" != '#'* ]]; then
+        continue
       fi
     fi
   fi
 
- # PRINT TO PAGE SECTION
   src=''
-  local=''
-  # if line is a header
+
+  # Track heading level
   if [[ "$line" == '#'* ]]; then
-  # if header has (#id-of-link) or {#id-on-page} patterns
     if [[ $line =~ (\(\#.*\))\. || "$line" =~ \{\#.*\} ]]; then
-      # isolate the matching part of line 
       match=${BASH_REMATCH[0]}
-      # remove match - leaving rest
       rest=${line//${match}}
-      # remove any # symbols from start 
       title_rest=${rest##*\#}
-      # slice rest of line to get only level
       level="${rest:0:$((${#rest} - ${#title_rest}))}"
     else
-    # any other headers -- these before SRC/LOCAL pages anchors
-      header=${line##*\#} 
+      header=${line##*\#}
       level="${line:0:$((${#line} - ${#header}))}"
     fi
-  # if line is SRC anchor in read file 
-  elif [[ "$line" == '<!-- SRC:'* ]]; then
-    # remove the first 10 chars
-    src=${line:10}
-    # % remove from end until after white space -- leaves src details
-    src=${src% *}
-  # if line is LOCAL anchor in read file 
-  elif [[ "$line" == '<!-- LOCAL:'* ]]; then
-    # remove the first 12 chars
-    local=${line:12}
-    # % remove from end until after white space -- leave local details
-    local=${local% *}
-    # leave only path to file
-    local=${local#* }
-  fi 
-  # prints line to the page 
+  # Detect SRC comment (MDX format)
+  elif [[ "$line" == '{/* SRC:'* ]]; then
+    src=${line:9}
+    src=${src%% \*/*}
+  fi
+
   echo "$line"
- 
-  if [[ -n "$local" ]]; then
-  # cat file -- outputs full contents of file at local path 
-    cat "$local" | \
-    # remove the top 1# headers from cat'd file
-      sed -En '/^##|^[^#]/,$p' | \
-    # remove GH MD specific tags start w '[!NOTE\] + the following line
-      sed -E '/^>\[!NOTE\]*/{N;d;}' | \
-    # change GH specific MD IMPORTANT tags -> change into plain MD
-      sed -E 's/> \[!IMPORTANT\]/> **IMPORTANT:** /g'
-      echo
-  elif [[ -n "$src" ]]; then  
+
+  if [[ -n "$src" ]]; then
     echo
     path=${src#* }
     repo=${src% *}
-    curl -s "https://raw.githubusercontent.com/${repo}/master/${path}" | \
-      # if line is ## or not #
-      sed -En '/^##|^[^#]/,$p' | \
-      # add additional # every header 
-      sed 's/^#/&'"${level:1}"'/g' | \
-      # format GH links when match
-      sed -E 's/(\[[^]]*\])\(([^):#]*)\)/\1(https:\/\/github.com\/'"$(sed 's/\//\\\//g' <<< "$repo")"'\/blob\/master\/\2)/g'
+
+    echo "fetching $repo/$path..." >&2
+    RAW=$(curl -s "https://raw.githubusercontent.com/${repo}/HEAD/${path}")
+
+    # Convert relative links to absolute GitHub URLs
+    BASEURL="https://github.com/${repo}/blob/HEAD"
+    RAW=$(echo "$RAW" | sed -E "s|\]\(([^)#/][^):]*)\)|](${BASEURL}/\1)|g")
+
+    TRANSFORMED=$(transform_content "$RAW" "$level")
+    echo "$TRANSFORMED"
     echo
   fi
-  # read in dest file then write back to file
 done <<<"$(< $DEST)" > $DEST
+
+echo "Updated $DEST"

.github/scripts/get-express-version.mjs

@@ -10,7 +10,6 @@
 (cat <<LIST_END
 expressjs body-parser master
 expressjs compression master
-expressjs connect-rid master
 expressjs cookie-parser master
 expressjs cookie-session master
 expressjs cors master
@@ -25,26 +24,88 @@ expressjs serve-static master
 expressjs session master
 expressjs timeout master
 expressjs vhost master
-expressjs express master/examples
 LIST_END
 ) | while read org repo branch; do
+  # TODO: change the DEST when astro project is in the root of the repo instead of in a subdirectory.
   # Write the README.md to a file named after the repo
-  DEST="../../_includes/readmes/$repo.md"
+  DEST="../../src/content/pages/en/resources/middleware/$repo.mdx"
   # When fetching from a branch of a gh repo
   GHURL="https://raw.githubusercontent.com/$org/$repo/$branch/README.md"
   # When fetching from the latest release of a node module
   NPMURL="https://registry.npmjs.org/$repo"
+
+  # Fetch version and description from npm registry
+  NPM_DATA=$(curl -s "$NPMURL")
+  VERSION=$(echo "$NPM_DATA" | jq -r '.["dist-tags"].latest // empty')
+  DESC=$(echo "$NPM_DATA" | jq -r '.description // empty')
+
+  # Preserve existing frontmatter if the file already exists
+  FRONTMATTER=""
+  if [ -f "$DEST" ]; then
+    FRONTMATTER=$(awk '/^---$/{c++;next} c==1{print} c==2{exit}' "$DEST")
+  fi
+
   if [ -z "$branch" ]; then
     # No branch means latest release, so fetch from npmjs.org
     echo "fetching $org/$repo from latest npmjs.org release..."
-    curl -s $NPMURL | jq -r '.readme|rtrimstr("\n")' > $DEST
+    CONTENT=$(echo "$NPM_DATA" | jq -r '.readme|rtrimstr("\n")')
   else
     # This allows us to specify a branch other than master if we want to.
     # In this case, the branch name is added to the readme name in the filename.
     if [ "$branch" != "master" ]; then
-      DEST="../../_includes/readmes/$repo-$branch.md"
+      DEST="../../src/content/pages/en/resources/middleware/$repo-$branch.mdx"
     fi
     echo "fetching $org/$repo/$branch from GitHub's raw content domain..."
-    curl -s $GHURL > $DEST
+    CONTENT=$(curl -s $GHURL)
+  fi
+
+  # Remove the first h1 heading (title is rendered by the layout)
+  CONTENT=$(echo "$CONTENT" | sed '0,/^# /{/^# /d}')
+
+  # Remove badge lines ([![...][...]][...] patterns and reference-style badge links)
+  CONTENT=$(echo "$CONTENT" | sed '/^\[\!\[.*\]\[.*\]\]\[.*\]$/d')
+  CONTENT=$(echo "$CONTENT" | sed '/^\[.*\]:.*img\.shields\.io/d')
+  CONTENT=$(echo "$CONTENT" | sed '/^\[.*\]:.*badgen\.net/d')
+  CONTENT=$(echo "$CONTENT" | sed '/^\[.*\]:.*coveralls\.io/d')
+  CONTENT=$(echo "$CONTENT" | sed '/^\[.*\]:.*github\.com\/.*\/actions/d')
+  CONTENT=$(echo "$CONTENT" | sed '/^\[.*\]:.*securityscorecards\.dev/d')
+  CONTENT=$(echo "$CONTENT" | sed '/^\[.*\]:.*opencollective\.com.*\/badge/d')
+  CONTENT=$(echo "$CONTENT" | sed '/^\[.*\]:.*bestpractices\.coreinfrastructure\.org/d')
+  # Remove HTML badge lines (<a><img></a> patterns)
+  CONTENT=$(echo "$CONTENT" | sed '/<a[^>]*><img[^>]*><\/a>/d')
+
+  # Convert GitHub callouts to Alert components
+  CONTENT=$(echo "$CONTENT" | perl -0777 -pe '
+    s/> \[!(IMPORTANT|NOTE|TIP|CAUTION|WARNING)\]\n((?:>.*\n)*)/
+      my $type = lc($1);
+      my %map = (important => "info", note => "info", tip => "info", caution => "warning", warning => "warning");
+      my $alert = $map{$type} || "info";
+      my $body = $2;
+      $body =~ s|^> ?||gm;
+      "<Alert type=\"$alert\">\n\n${body}\n<\/Alert>\n"
+    /ge')
+
+  # Convert HTML comments to MDX comments
+  CONTENT=$(echo "$CONTENT" | sed -E 's/<!--(.*)-->/\{\/\*\1\*\/\}/g')
+
+  # Convert self-closing HTML tags for MDX compatibility
+  CONTENT=$(echo "$CONTENT" | sed -E 's/<(br|hr|img)([^/]*[^/])?\s*>/<\1\2 \/>/gi')
+
+  # Convert relative links to absolute GitHub URLs
+  BASEURL="https://github.com/$org/$repo/blob/HEAD"
+  CONTENT=$(echo "$CONTENT" | sed -E "s|\]\(([^)#/][^):]*)\)|](${BASEURL}/\1)|g")
+
+  # Build the MDX import and component
+  IMPORT="import MiddlewareInfo from '@components/patterns/MiddlewareInfo/MiddlewareInfo.astro';
+import Alert from '@components/primitives/Alert/Alert.astro';"
+  GITHUB_URL="https://github.com/$org/$repo"
+  NPM_PAGE="https://www.npmjs.com/package/$repo"
+  COMPONENT="<MiddlewareInfo version=\"${VERSION}\" github=\"${GITHUB_URL}\" npm=\"${NPM_PAGE}\" />"
+
+  # Write with frontmatter preserved
+  if [ -n "$FRONTMATTER" ]; then
+    printf '%s\n%s\n%s\n\n%s\n\n%s\n\n%s\n' "---" "$FRONTMATTER" "---" "$IMPORT" "$COMPONENT" "$CONTENT" > $DEST
+  else
+    printf '%s\n%s\n%s\n%s\n\n%s\n\n%s\n\n%s\n' "---" "title: $repo middleware" "description: $DESC" "---" "$IMPORT" "$COMPONENT" "$CONTENT" > $DEST
   fi
 done